security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas)

nicolas-grekas · nicolas-grekas · commit 399ddbf0ff98 · 2019-04-16T11:37:00.000+02:00
This PR was merged into the 3.4 branch. Discussion ---------- [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | - Reported for `FilesystemCommonTrait` at https://www.intigriti.com/company/submission/CfDJ8Pja6NZvkpNCmx5vVyiGSn7yW8c1j4H0-cnAhIk6fbstOMm028X-XD1kmSuQkGB2n0cRyyVrA2yAiLN_I0EVilaKVLSiSa0UXZJGfN1h85vmk5c2dBBpu619r1YQEIjcXA Commits ------- 4fb9752816 Prevent destructors with side-effects from being unserialized
diff --git a/Traits/FilesystemCommonTrait.php b/Traits/FilesystemCommonTrait.php
@@ -116,6 +116,16 @@ public static function throwError($type, $message, $file, $line)
         throw new \ErrorException($message, 0, $type, $file, $line);
     }
 
+    public function __sleep()
+    {
+        throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
+    }
+
+    public function __wakeup()
+    {
+        throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
+    }
+
     public function __destruct()
     {
         if (method_exists(parent::class, '__destruct')) {
