From 26d7ba4417abb9444addb7ab3ef58a87dec25017 Mon Sep 17 00:00:00 2001 From: XananasX7 Date: Sun, 31 May 2026 02:52:33 +0000 Subject: [PATCH] security: add allowed_classes => false to Core::safeUnserialize() as defence-in-depth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Core::safeUnserialize() validates the serialized string with a custom parser before calling unserialize(). The parser only permits scalar types (s, b, i, d, N) and plain arrays (a), blocking object tokens ('O:' / 'C:'). However, the final unserialize() call does not pass allowed_classes, which means a parser bypass or edge-case in the manual tokeniser could still allow object instantiation. Adding allowed_classes => false ensures that even if the manual validator is somehow bypassed (e.g., by a future PHP serialization format change or a subtle parser bug), unserialize() itself will refuse to instantiate PHP objects — providing a second layer of protection. Signed-off-by: El Mehdi Abenhazou --- src/Core.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/Core.php b/src/Core.php index f12e7efbef..be83ec94d9 100644 --- a/src/Core.php +++ b/src/Core.php @@ -640,7 +640,11 @@ class Core return null; } - return unserialize($data); + // The manual parser above only permits scalars and plain arrays (s/b/i/d/N/a); + // any object token ('O:'/'C:') causes an early return null. Explicitly passing + // allowed_classes => false here adds defence-in-depth in case of parser edge + // cases and makes the intent clear to static analysis tools. + return unserialize($data, ['allowed_classes' => false]); } /**