Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:78406 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 93616 invoked from network); 27 Oct 2014 20:47:59 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 27 Oct 2014 20:47:59 -0000 Authentication-Results: pb1.pair.com smtp.mail=ajf@ajf.me; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=ajf@ajf.me; sender-id=pass Received-SPF: pass (pb1.pair.com: domain ajf.me designates 192.64.116.208 as permitted sender) X-PHP-List-Original-Sender: ajf@ajf.me X-Host-Fingerprint: 192.64.116.208 imap2-3.ox.privateemail.com Received: from [192.64.116.208] ([192.64.116.208:51120] helo=imap2-3.ox.privateemail.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 75/17-56216-D7FAE445 for ; Mon, 27 Oct 2014 15:47:58 -0500 Received: from localhost (localhost [127.0.0.1]) by mail.privateemail.com (Postfix) with ESMTP id 404B38C007D; Mon, 27 Oct 2014 16:47:55 -0400 (EDT) X-Virus-Scanned: Debian amavisd-new at imap2.ox.privateemail.com Received: from mail.privateemail.com ([127.0.0.1]) by localhost (imap2.ox.privateemail.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id HVv0pHTk3393; Mon, 27 Oct 2014 16:47:55 -0400 (EDT) Received: from oa-res-26-28.wireless.abdn.ac.uk (oa-res-26-28.wireless.abdn.ac.uk [137.50.26.28]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.privateemail.com (Postfix) with ESMTPSA id 869278C007B; Mon, 27 Oct 2014 16:47:54 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 8.0 \(1990.1\)) In-Reply-To: Date: Mon, 27 Oct 2014 20:47:52 +0000 Cc: PHP Internals Content-Transfer-Encoding: quoted-printable Message-ID: <6D4F040F-B8E0-4532-8225-A1240D20DAC6@ajf.me> References: <544DFC5F.9020408@sugarcrm.com> To: Stas Malyshev X-Mailer: Apple Mail (2.1990.1) Subject: Re: [PHP-DEV] [RFC] Serialize filtering From: ajf@ajf.me (Andrea Faulds) > On 27 Oct 2014, at 20:38, Andrea Faulds wrote: >=20 >=20 >> On 27 Oct 2014, at 08:03, Stas Malyshev = wrote: >>=20 >> I'd like to have a vote on unserialize() improvement proposal = outlined here: >> https://wiki.php.net/rfc/secure_unserialize >=20 > Suggestion on improving the API: Why bother with three values? >=20 > If there=E2=80=99s no parameter, use current behaviour. If there=E2=80=99= s an array, it=E2=80=99s allowed classes. If that array is empty, = obviously there are no allowed classes. For example: // this will unserialize everything as before $data =3D unserialize($foo); // this will convert all objects into __PHP_Incomplete_Class object $data =3D unserialize($foo, []); // this will convert all objects except ones of MyClass and MyClass2 = into __PHP_Incomplete_Class object $data =3D unserialize($foo, ["MyClass", =E2=80=9CMyClass2"]); -- Andrea Faulds http://ajf.me/