Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125456
Feedback-ID: ifab94697:Fastmail
Precedence: bulk
MIME-Version: 1.0
Date: Fri, 06 Sep 2024 20:44:36 +0200
To: "Claude Pache" <claude.pache@gmail.com>,
 "John Coggeshall" <john@coggeshall.org>
Cc: "Philip Hofstetter" <phofstetter@sensational.ch>,
 "PHP internals" <internals@lists.php.net>
Message-ID: <bb5f915e-71ab-4582-9424-17cc9fe0e6fa@app.fastmail.com>
In-Reply-To: <B3E431AC-074E-42B0-B770-139456579861@gmail.com>
References: 
 <CAGKNXQG32aF58gPnf1ywbmde72F_Wwjib0oXhN_ve6336RnQXg@mail.gmail.com>
 <98553A91-FD3F-4E1B-91D9-D8B00CAD5FC5@getmailspring.com>
 <B3E431AC-074E-42B0-B770-139456579861@gmail.com>
Subject: Re: [PHP-DEV] RFC: Deprecate json_encode() on classes marked as
 non-serializable
Content-Type: multipart/alternative;
 boundary=6e1d5dc5e07f4468b8bdc2c91e31f18d
From: rob@bottled.codes ("Rob Landers")

--6e1d5dc5e07f4468b8bdc2c91e31f18d
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On Fri, Sep 6, 2024, at 20:07, Claude Pache wrote:
>=20
>=20
>> Le 5 sept. 2024 =C3=A0 18:03, John Coggeshall <john@coggeshall.org> a=
 =C3=A9crit :
>>=20
>>=20
>>> As per my previous email to the list, I have now created the officia=
l RFC to deprecate calling json_serialize() on instances of classes mark=
ed with ZEND_ACC_NOT_SERIALIZABLE.
>>=20
>> I would suggest we take a step back from this and look at it with a b=
it more of a wider lens. It seems to me that this would be a good place =
to have an attribute (e.g. `#[NotSerializable]` )  that could be defined=
 for any class (with `ZEND_ACC_NOT_SERIALIZABLE`  being automatically gi=
ven this attribute)? It just seems to be a more holistic approach that m=
akes sense, rather than basing it on internal engine stuff and/or limiti=
ng it to internal objects.
>>=20
>> Coogle
>>=20
> Hi,
>=20
> An attribute adds very little value. It doesn=E2=80=99t add new capabi=
lity, because you can achieve the same effect with a serialiser that thr=
ows unconditionally; it is just a nicer syntax. People generally don=E2=80=
=99t bother making their classes unserialisable unless they have a good =
reason; having an attribute won=E2=80=99t really change that.

You also need to ensure that you make it final, as someone could extend =
your class and make your borked serializer work.

> The core problem is that objects are json-serialisable by default, alt=
hough most of them are not supposed to be json-serialised. Taking a seco=
nd step back, if we really want to solve the issue, one should:
>=20
> * for internal classes, determine which ones could be json-serialisabl=
e (at least, stdClass); for all other classes, `json_encode(...)` shall =
be disabled (after a deprecation period);
> * for user-defined classes, the user shall opt into json-serialisabili=
ty, either by extending a json-serialisable class, or by using an {attri=
bute / magic method / interface} (chose your bikeshed colour).
>=20
> =E2=80=94Claude

I also agree with this to a point: there is the https://www.php.net/manu=
al/en/class.jsonserializable.php interface, after all.

=E2=80=94 Rob
--6e1d5dc5e07f4468b8bdc2c91e31f18d
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title><style type=3D"text/css">p.Mso=
Normal,p.MsoNoSpacing{margin:0}</style></head><body><div>On Fri, Sep 6, =
2024, at 20:07, Claude Pache wrote:<br></div><blockquote type=3D"cite" i=
d=3D"qt" style=3D"overflow-wrap:break-word;"><div><br></div><div><div><b=
r></div><blockquote type=3D"cite"><div>Le 5 sept. 2024 =C3=A0 18:03, Joh=
n Coggeshall &lt;john@coggeshall.org&gt; a =C3=A9crit :<br></div><div><b=
r></div><div><div><br></div><blockquote><div><div><div class=3D"qt-gmail=
_signature"><div>As per my previous email to the list, I have now create=
d the official RFC to deprecate calling json_serialize() on instances of=
 classes marked with ZEND_ACC_NOT_SERIALIZABLE.<br></div></div></div></d=
iv></blockquote><div><div><div class=3D"qt-gmail_signature"><div><br></d=
iv><div>I would suggest we take a step back from this and look at it wit=
h a bit more of a wider lens. It seems to me that this would be a good p=
lace to have an attribute (e.g. <code>#[NotSerializable]</code>&nbsp;)&n=
bsp; that could be defined for any class (with <code>ZEND_ACC_NOT_SERIAL=
IZABLE</code>&nbsp; being automatically given this attribute)? It just s=
eems to be a more holistic approach that makes sense, rather than basing=
 it on internal engine stuff and/or limiting it to internal objects.<br>=
</div><div><br></div><div>Coogle<br></div><div><br></div></div></div></d=
iv></div></blockquote></div><div>Hi,<br></div><div><br></div><div>An att=
ribute adds very little value. It doesn=E2=80=99t add new capability, be=
cause you can achieve the same effect with a serialiser that throws unco=
nditionally; it is just a nicer syntax. People generally don=E2=80=99t b=
other making their classes unserialisable unless they have a good reason=
; having an attribute won=E2=80=99t really change that.<br></div></block=
quote><div><br></div><div>You also need to ensure that you make it final=
, as someone could extend your class and make your borked serializer wor=
k.<br></div><div><br></div><blockquote type=3D"cite" id=3D"qt" style=3D"=
overflow-wrap:break-word;"><div>The core problem is that objects are jso=
n-serialisable by default, although most of them are not supposed to be =
json-serialised. Taking a second step back, if we really want to solve t=
he issue, one should:<br></div><div><br></div><div>* for internal classe=
s, determine which ones could be json-serialisable (at least, stdClass);=
 for all other classes, `json_encode(...)` shall be disabled (after a de=
precation period);<br></div><div>* for user-defined classes, the user sh=
all opt into json-serialisability, either by extending a json-serialisab=
le class, or by using an {attribute / magic method / interface} (chose y=
our bikeshed colour).<br></div><div><br></div><div>=E2=80=94Claude<br></=
div></blockquote><div><br></div><div>I also agree with this to a point: =
there is the&nbsp;<a href=3D"https://www.php.net/manual/en/class.jsonser=
ializable.php">https://www.php.net/manual/en/class.jsonserializable.php<=
/a>&nbsp;interface, after all.<br></div><div><br></div><div id=3D"sig121=
229152">=E2=80=94 Rob<br></div></body></html>
--6e1d5dc5e07f4468b8bdc2c91e31f18d--