Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:78756
Return-Path: <patrick.allaert@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 20027 invoked from network); 5 Nov 2014 23:11:02 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 5 Nov 2014 23:11:02 -0000
Authentication-Results: pb1.pair.com smtp.mail=patrick.allaert@gmail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=patrick.allaert@gmail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.47 as permitted sender)
X-PHP-List-Original-Sender: patrick.allaert@gmail.com
X-Host-Fingerprint: 209.85.218.47 mail-oi0-f47.google.com  
Received: from [209.85.218.47] ([209.85.218.47:63197] helo=mail-oi0-f47.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 2C/10-18902-48EAA545 for <internals@lists.php.net>; Wed, 05 Nov 2014 18:11:01 -0500
Received: by mail-oi0-f47.google.com with SMTP id a3so134691oib.20
        for <internals@lists.php.net>; Wed, 05 Nov 2014 15:10:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:sender:in-reply-to:references:date:message-id:subject
         :from:to:cc:content-type;
        bh=rX26xMfxC+BisG3kQ1rCDp2cNbHw1QU0TBuTDzhrZ9o=;
        b=twmSVQPFKcwmaCcN35m0JURiq9FmbdE2Yqfoyl0CkSJ54XHmSYuzAn+x2yC0kGhZZ9
         fXEZvCKIT2Y9JQGfuq1T4OecFwHb+mGgVDvpuONjPjXLnaL0VspIwJ8l1lzincGhiE5j
         QzFvRnrgne9FWDG3HWihbUGnzgof2mVT/mB1yooGhHZ/jUDyYifq4omL+y0qfZqJZnko
         DDpTJ5sMNEoVVoRGGpkaDO4XBlJ4fR89yEKMYiRj9a9sLAO7hOYfpXnJIvwb/3XihY5X
         AjIU2gzQo8G/BI9PHvN9s4+jErM9W5VCt6bQg5SQvAqnwbOHdBlHbqJxSuarKiofxxjO
         ZlpA==
MIME-Version: 1.0
X-Received: by 10.202.208.211 with SMTP id h202mr257744oig.29.1415229058016;
 Wed, 05 Nov 2014 15:10:58 -0800 (PST)
Sender: patrick.allaert@gmail.com
Received: by 10.76.79.199 with HTTP; Wed, 5 Nov 2014 15:10:57 -0800 (PST)
In-Reply-To: <CA+9eiLsD5-zqSHR1u4b=jb7sEDR7COTKNxpzOBPXJfTqnrqspQ@mail.gmail.com>
References: <5457EF60.1020103@sugarcrm.com>
	<CAF+90c-gRf33Fwqsf00JRLPVuXYjXS2yM4gHYcHUepQ_ynZ9uQ@mail.gmail.com>
	<54591EC3.9080202@sugarcrm.com>
	<CA+9eiLsD5-zqSHR1u4b=jb7sEDR7COTKNxpzOBPXJfTqnrqspQ@mail.gmail.com>
Date: Thu, 6 Nov 2014 00:10:57 +0100
X-Google-Sender-Auth: J31Bg_i-7AvADh8DEol6xpRODaY
Message-ID: <CACwt+JfELd-1XEUpwr2ttdD6D9zq2t4kWK-1Fh18WyQQQRChaA@mail.gmail.com>
To: Dmitry Stogov <dmitry@zend.com>
Cc: Stas Malyshev <smalyshev@sugarcrm.com>, Nikita Popov <nikita.ppv@gmail.com>, 
	PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] [VOTE] Filtered unserialize()
From: patrickallaert@php.net (Patrick ALLAERT)

2014-11-04 20:48 GMT+01:00 Dmitry Stogov <dmitry@zend.com>:
> I agree with Nikita.
> Adding an extra argument for one particular security related case looks
> weird.

Same opinion here.

Unfortunately, I can't propose something more robust instead, but I
have the feeling that this RFC tries to solve the symptoms of some
deeper problems with a short-term vision only.

What if I want to unserialize an object of class A which has a
reference to class B? Should "B" be part of the filter? And what if B
has, in turn, some other class references?

I'm +1 for addressing the issue that this RFC tries to solve, but not
in the current state.

Regards,
Patrick