standard: Fail unserialization when the C format is used for classes that are not Serializable#22058
Conversation
TimWolla
left a comment
TimWolla
left a comment
There was a problem hiding this comment.
As mentioned in the issue, this should get a general fix. But the patch LGTM if we decide for some reason not to fix this generally.
kocsismate
requested review from
DanielEScherzer,
Girgias,
NattyNarwhal,
SakiTakamachi,
adoy,
alexdowad,
arnaud-lb,
bukka,
derickr,
devnexen,
dstogov,
kamil-tekiela,
youkidearitai and
zeriyoshi
as code owners
github-actions
Bot
added
Extension: mysqlnd
Extension: odbc
Extension: opcache
Extension: pcntl
Extension: pcre
Extension: pdo (core)
Extension: pdo_dblib
Extension: pdo_firebird
Extension: pdo_mysql
Extension: pdo_odbc
Extension: pdo_pgsql
Extension: pdo_sqlite
Extension: pgsql
Extension: phar
Extension: posix
Extension: readline
Extension: reflection
Extension: session
Extension: shmop
Extension: simplexml
labels
iluuu1994
left a comment
iluuu1994
left a comment
There was a problem hiding this comment.
IMO, fuzzing-style issues (things that are effectively impossible to happen by accident) should be fixed on master, assuming they don't pose a security risk (which this does not).
Yes, I think you are right! So I changed the target branch to master. |
TimWolla
left a comment
TimWolla
left a comment
There was a problem hiding this comment.
PR should be retitled to indicate that it's not a fix that is specific to ext/uri. UPGRADING and NEWS should be added. But the change itself LGTM.
TimWolla
left a comment
TimWolla
left a comment
There was a problem hiding this comment.
I've made an(other) (opinionated) retitle of the PR to describe the change that has been made, rather than describing the symptoms.
Diff LGTM now. Don't forget to add NEWS.
[skip ci]
4 participants
Unserializing from the "C" format is explicitly disabled.
Fixes GH-22046.