mirror of
https://github.com/php/php-src.git
synced 2026-04-30 03:33:17 +02:00
Nikita Popov
814a932734
This prevents serialization and unserialization of a class and its children in a way that does not depend on the zend_class_serialize_deny and zend_class_unserialize_deny handlers that will be going away in PHP 9 together with the Serializable interface. In stubs, `@not-serializable` can be used to set this flag. This patch only uses the new flag for a handful of Zend classes, converting the remainder is left for later. Closes GH-7249. Fixes bug #81111.
14 lines
375 B
PHP
14 lines
375 B
PHP
--TEST--
|
|
Bug #67072 Echoing unserialized "SplFileObject" crash
|
|
--FILE--
|
|
<?php
|
|
echo unserialize('O:13:"SplFileObject":1:{s:9:"*filename";s:15:"/home/flag/flag";}');
|
|
?>
|
|
===DONE==
|
|
--EXPECTF--
|
|
Fatal error: Uncaught Exception: Unserialization of 'SplFileObject' is not allowed in %s:%d
|
|
Stack trace:
|
|
#0 %s(%d): unserialize('O:13:"SplFileOb...')
|
|
#1 {main}
|
|
thrown in %s on line %d
|