Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:12610 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 52670 invoked by uid 1010); 6 Sep 2004 09:19:19 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 48402 invoked from network); 6 Sep 2004 09:17:43 -0000 Received: from unknown (HELO chatserv.de) (217.160.175.43) by pb1.pair.com with SMTP; 6 Sep 2004 09:17:43 -0000 Received: (qmail 13582 invoked by uid 1040); 6 Sep 2004 09:17:36 -0000 Received: from unknown (HELO localhost) (127.0.0.1) by localhost with SMTP; 6 Sep 2004 09:17:36 -0000 Date: Mon, 6 Sep 2004 11:17:36 +0200 (CEST) X-X-Sender: sas@chatserv To: Jason Garber cc: Markus Fischer , internals@lists.php.net In-Reply-To: <1344526455.20040906043803@ionzoft.com> Message-ID: References: <1379406779.20040905153328@ionzoft.com> <413BF576.70104@fischer.name> <1344526455.20040906043803@ionzoft.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: Re: [PHP-DEV] unserialize() data from untrusted source From: sascha@schumann.cx (Sascha Schumann) > As I said, over the years I've done both, and this is what I've > settled on as the most practical. Then you should have learned by now that verifying your data's integrity is a mandatory task when designing any client-side session system. Otherwise, attackers can inject any kind of data into your system where the falsified data will be viewed as 'trusted'. Once you add the integrity check, you have also eliminated the possibility that arbitrary classes could be instantiated. - Sascha