Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:123597
Precedence: bulk
MIME-Version: 1.0
References: <CAPyeZ4O2rK+2ApuE-YLc7j_Z2LcT29yHcLYXvB0oGs-D_zTSag@mail.gmail.com>
 <CAMjSS5OPKm0dRP+ckCdpBd4Kg1aRhU5QgcuTWwPTnyC_1aZRkw@mail.gmail.com>
In-Reply-To: <CAMjSS5OPKm0dRP+ckCdpBd4Kg1aRhU5QgcuTWwPTnyC_1aZRkw@mail.gmail.com>
Date: Fri, 14 Jun 2024 01:24:48 +0300
Message-ID: <CAPyeZ4PCGuosZMrj9jvwXQnBuSdoqXsVFEEArUDpOkxTMk_h+Q@mail.gmail.com>
Subject: Re: [PHP-DEV] Revisiting case-sensitivity in PHP
To: Timo Tijhof <ttijhof@wikimedia.org>
Cc: php internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000002b8ce4061accf888"
From: udaltsov.valentin@gmail.com (Valentin Udaltsov)

--0000000000002b8ce4061accf888
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Friday, 14 June, 2024=E2=80=AF=D0=B3. at 00:04, Timo Tijhof <ttijhof@wik=
imedia.org>
wrote:

> Would this affect unserialize()?
>
> I ask because MediaWiki's main "text" database table is an
> immutable/append-only store where we store the text of each page revision
> since ~2004. It is stored as serialised blobs of a value class. There hav=
e
> been a number of different implementations over the past twenty years of
> Wikipedia's existence (plain text, gzip-compressed, diff-compressed, etc.=
).
>
> When we adopted modern autoloading in MediaWiki, we quickly found that
> blobs originally serialized by PHP 4 actually encoded the class in
> lowercase, regardless of the casing in source code.
>
> From https://3v4l.org/jl0et:
>
>> class ConcatenatedGzipHistoryBlob {=E2=80=A6}
>> print serialize($blob);
>> # PHP 4.x: O:27:"concatenatedgziphistoryblob":=E2=80=A6
>> # PHP 5/7/8: O:27:"ConcatenatedGzipHistoryBlob":=E2=80=A6
>
>
> It is of course the application's responsibility to load these classes,
> but, it is arguably PHP's responsiblity to be able to construct what it
> serialized. I suppose anything is possible when announced as a breaking
> change for PHP 9.0. I wanted to share this as something to take into
> consideration as part of the impact. Potentially worthy of additional
> communicating, or perhaps worth supporting separately.
>
> --
> Timo Tijhof,
> Principal Engineer,
> Wikimedia Foundation.
> https://timotijhof.net/
>
>
Hi, Timo!

Thank you very much for bringing up this important case.

Here's how I see this. If PHP gets class case-sensitivity, unserialization
of classes with lowercase names will fail. This is because the engine will
start putting `MyClass` class entry with key `MyClass` (not `myclass`) into
the loaded classes table and serialization will not be able to find it as
`myclass`.
Even if some deprecation layer is introduced (that puts both `myclass` and
`MyClass` keys into the table), you will first have a ton of notices and
then eventually end up with the same problem, when transition to case
sensitivity is complete. Hence I propose no deprecation layer =E2=80=94 it =
does not
really help.

However, you will be able to use `class_alias()` to solve your issue. If
classes are case-sensitive, `class_alias(MyClass::class, 'myclass');`
should work, since MyClass !=3D myclass anymore. And serialization works
perfectly with class aliases, see https://3v4l.org/1n1as .

--
Valentin Udaltsov

--0000000000002b8ce4061accf888
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>On Friday, 14 June, 2024=E2=80=AF=D0=B3. at 00:04, Ti=
mo Tijhof &lt;<a href=3D"mailto:ttijhof@wikimedia.org">ttijhof@wikimedia.or=
g</a>&gt; wrote:<br></div><div class=3D"gmail_quote"><blockquote class=3D"g=
mail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204=
,204,204);padding-left:1ex"><div dir=3D"ltr"><div>Would this affect unseria=
lize()?<br></div><div><br></div><div>I ask because MediaWiki&#39;s main &qu=
ot;text&quot; database table is an immutable/append-only store where we sto=
re the text of each page revision since ~2004. It is stored as serialised b=
lobs of a value class. There have been a number of different implementation=
s over the past twenty years of Wikipedia&#39;s existence (plain text, gzip=
-compressed, diff-compressed, etc.).<br></div><div><br></div><div>When we a=
dopted modern autoloading in MediaWiki, we quickly found that blobs origina=
lly serialized by PHP 4 actually encoded the class in lowercase, regardless=
 of the casing in source code.<br></div><div><br></div><div>From <a href=3D=
"https://3v4l.org/jl0et" target=3D"_blank">https://3v4l.org/jl0et</a>:<br><=
/div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bo=
rder-left:1px solid rgb(204,204,204);padding-left:1ex">class ConcatenatedGz=
ipHistoryBlob {=E2=80=A6}<br>print serialize($blob);<br># PHP 4.x: O:27:&qu=
ot;concatenatedgziphistoryblob&quot;:=E2=80=A6<br># PHP 5/7/8: O:27:&quot;C=
oncatenatedGzipHistoryBlob&quot;:=E2=80=A6</blockquote><div><div><br></div>=
<div>It is of course the application&#39;s responsibility to load these cla=
sses, but, it is arguably PHP&#39;s responsiblity to be able to construct w=
hat it serialized. I suppose anything is possible when announced as a break=
ing change for PHP 9.0. I wanted to share this as something to take into co=
nsideration as part of the impact. Potentially worthy of additional communi=
cating, or perhaps worth supporting separately.<br></div><div><br></div><di=
v>--<br></div><div>Timo Tijhof,<br></div><div>Principal Engineer,<br></div>=
<div>Wikimedia Foundation.<br></div><div><a href=3D"https://timotijhof.net/=
" target=3D"_blank">https://timotijhof.net/</a></div><div><br></div></div><=
/div>
</blockquote></div><br clear=3D"all"><div>Hi, Timo!=C2=A0<br><br>Thank you =
very much for bringing up=C2=A0this=C2=A0important=C2=A0case.<br><br>Here&#=
39;s how I see this. If PHP gets=C2=A0class=C2=A0case-sensitivity, unserial=
ization of classes with lowercase names will fail. This is because the=C2=
=A0engine will start putting `MyClass` class entry with key `MyClass` (not =
`myclass`) into the loaded=C2=A0classes table and serialization will not be=
 able to find it as `myclass`.</div><div>Even=C2=A0if some deprecation laye=
r is introduced (that puts both `myclass` and `MyClass` keys into the table=
), you will first have a ton of notices and then eventually end up with the=
 same problem,=C2=A0when transition=C2=A0to case sensitivity is complete. H=
ence I propose no deprecation layer =E2=80=94 it does not really help.</div=
><div><br></div><div>However, you will be able to use `class_alias()` to so=
lve your issue. If classes are case-sensitive, `class_alias(MyClass::class,=
 &#39;myclass&#39;);` should work,=C2=A0since MyClass !=3D myclass anymore.=
 And serialization works perfectly with class aliases, see=C2=A0<a href=3D"=
https://3v4l.org/1n1as">https://3v4l.org/1n1as</a> .</div><div><br></div><s=
pan class=3D"gmail_signature_prefix">--</span><div><div dir=3D"ltr" class=
=3D"gmail_signature"><div dir=3D"ltr">Valentin Udaltsov<br><br></div></div>=
</div></div>

--0000000000002b8ce4061accf888--