# RFC: Unbundle ext/wddx - Status: Implemented (PHP 7.4) - Authors: Christoph M. Becker, cmb@php.net - Date: 2018-01-17 - Version: 1.1.1 - Original: https://wiki.php.net/rfc/deprecate-and-remove-ext-wddx - Page: https://externals.io/rfc/deprecate-and-remove-ext-wddx - More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt ## Votes ### Unbundle ext/wddx (closed) Yes: 30 · No: 0 Voters: ashnazg (Yes), bwoebi (Yes), carusogabriel (Yes), cmb (Yes), diegopires (Yes), emir (Yes), galvao (Yes), girgias (Yes), guilhermeblanco (Yes), heiglandreas (Yes), hywan (Yes), jhdxr (Yes), jpauli (Yes), kalle (Yes), kguest (Yes), laruence (Yes), lex (Yes), malukenho (Yes), mariano (Yes), nikic (Yes), ocramius (Yes), petk (Yes), rasmus (Yes), remi (Yes), reywob (Yes), salathe (Yes), sebastian (Yes), stas (Yes), trowski (Yes), yunosh (Yes) ### Unbundle ext/wddx details (closed) depr. 7.4/move 8.0(1): 4 · depr. and move 7.4(2): 19 · move 7.4(3): 2 · dump 7.4(4): 3 Voters: ashnazg (depr. and move 7.4(2)), bwoebi (depr. and move 7.4(2)), carusogabriel (depr. and move 7.4(2)), chregu (depr. and move 7.4(2)), diegopires (depr. and move 7.4(2)), emir (depr. and move 7.4(2)), galvao (depr. 7.4/move 8.0(1)), girgias (dump 7.4(4)), guilhermeblanco (depr. and move 7.4(2)), heiglandreas (depr. 7.4/move 8.0(1)), hywan (depr. and move 7.4(2)), jhdxr (depr. 7.4/move 8.0(1)), kalle (dump 7.4(4)), kguest (depr. and move 7.4(2)), lex (depr. and move 7.4(2)), malukenho (depr. and move 7.4(2)), mariano (depr. and move 7.4(2)), nikic (depr. and move 7.4(2)), ocramius (depr. and move 7.4(2)), petk (depr. and move 7.4(2)), rasmus (depr. and move 7.4(2)), remi (move 7.4(3)), reywob (depr. and move 7.4(2)), salathe (depr. 7.4/move 8.0(1)), sebastian (dump 7.4(4)), stas (move 7.4(3)), trowski (depr. and move 7.4(2)), yunosh (depr. and move 7.4(2)) ## Discussions on the mailing list - [WDDX serialization and security](https://externals.io/message/100183.md) — started on 2017-08-11, 9 messages - [\[RFC\] Deprecate class instance deserialization in WDDX](https://externals.io/message/100220.md) — started on 2017-08-15, 5 messages - [\[RFC} Deprecate and Remove ext/wwdx](https://externals.io/message/103164.md) — started on 2018-09-16, 16 messages - [\[VOTE\] RFC: Unbundle ext/wddx](https://externals.io/message/103755.md) — started on 2019-01-17, 17 messages --- ## Introduction WDDX has been designed as programming language independent data exchange format for the web[1)](#fn__1). However, it never has been formally standardized, and it appears that it has been mostly superseeded by other data exchange formats such as JSON. A particular problem is that PHP 4.0.0 added the ability to (de)serialize class instances[2)](#fn__2) including calls to `_​_sleep()` and `__wakeup()`, respectively. Therefore, `wddx_deserialize()` must not be called on untrusted user input to avoid remote code execution, basically defeating the purpose of WDDX. A former RFC proposed to “[Deprecate class instance deserialization in WDDX](https://externals.io/rfc/wddx-deprecate-class-instance-deserialization)”, but it has been withdrawn since that would break BC, and there seemed to be generally more consensus on deprecating the extension altogether. ## Proposal Therefore I suggest to unbundle ext/wddx. A secondary vote will be held about the detailed procedure: 1. deprecate all functionality of the extension for PHP 7.4; move to PECL for PHP 8 2. deprecate all functionality of the extension \*and\* move to PECL for PHP 7.4 3. move the extension to PECL for PHP 7.4 4. dump the extension for PHP 7.4 (unbundle without moving to PECL or somewhere else) ## Backward Incompatible Changes Obviously, code using the wddx extension would issue deprecation warnings, and/or would have to use the wddx extension from PECL (or somewhere else), or be rewritten. ## Open Issues - None ## Voting The primary vote is about whether to unbundle ext/wddx, which requires a 2/3 majority. **Vote: Unbundle ext/wddx** — Yes: 30 · No: 0 (closed) A secondary vote is held about the detailed procedure (see the [proposal](#proposal) above). If the primary vote passes, the alternative with the most votes will be accepted. **Vote: Unbundle ext/wddx details** — depr. 7.4/move 8.0(1): 4 · depr. and move 7.4(2): 19 · move 7.4(3): 2 · dump 7.4(4): 3 (closed) Voting starts on 2019-01-17, and ends on 2019-01-31. ## Patches and Tests None, yet. ## Implementation 1. [Applied](http://git.php.net/?p=php-src.git;a=commit;h=6bbb18a0b6bef11222caaa55c00abdbcbb55d54b) to PHP-7.4 2. [Documentation](http://svn.php.net/viewvc?view=revision&revision=347028) ## References - Former discussion regarding [WDDX serialization and security](https://externals.io/message/100183) - Discussion of the [former RFC](https://externals.io/message/100220) ## Rejected Features None. [1)](#fnt__1) [2)](#fnt__2)