8000 bug #39794 Dont allow unserializing classes with a destructor - 4.4 (… · symfony/symfony@b85611f · GitHub
[go: up one dir, main page]
Skip to content

Commit b85611f

Browse files
nicolas-grekasnicolas-grekas
committed
bug #39794 Dont allow unserializing classes with a destructor - 4.4 (jderusse)
This PR was merged into the 4.4 branch. Discussion ---------- Dont allow unserializing classes with a destructor - 4.4 | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | - | License | MIT | Doc PR | - Prevent destructors with side-effects from being unserialized Commits ------- 955395c Dont allow unserializing classes with a destructor - 4.4
2 parents bde3e28 + 955395c commit b85611f

File tree

8 files changed

+76
-0
lines changed

8 files changed

+76
-0
lines changed

‎src/Symfony/Bridge/Monolog/Handler/ElasticsearchLogstashHandler.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,16 @@ private function sendToElasticsearch(array $records)
129129
$this->wait(false);
130130
}
131131

132+
public function __sleep()
133+
{
134+
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
135+
}
136+
137+
public function __wakeup()
138+
{
139+
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
140+
}
141+
132142
public function __destruct()
133143
{
134144
$this->wait(true);

‎src/Symfony/Component/ErrorHandler/BufferingLogger.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,16 @@ public function cleanLogs(): array
3535
return $logs;
3636
}
3737

38+
public function __sleep()
39+
{
40+
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
41+
}
42+
43+
public function __wakeup()
44+
{
45+
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
46+
}
47+
3848
public function __destruct()
3949
{
4050
foreach ($this->logs as [$level, $message, $context]) {

‎src/Symfony/Component/HttpClient/Chunk/ErrorChunk.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,16 @@ public function didThrow(): bool
115115
return $this->didThrow;
116116
}
117117

118+
public function __sleep()
119+
{
120+
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
121+
}
122+
123+
public function __wakeup()
124+
{
125+
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
126+
}
127+
118128
public function __destruct()
119129
{
120130
if (!$this->didThrow) {

‎src/Symfony/Component/HttpClient/CurlHttpClient.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,16 @@ public function reset()
362362
}
363363
}
364364

365+
public function __sleep()
366+
{
367+
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
368+
}
369+
370+
public function __wakeup()
371+
{
372+
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
373+
}
374+
365375
public function __destruct()
366376
{
367377
$this->reset();

‎src/Symfony/Component/HttpClient/HttplugClient.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,16 @@ public function createUri($uri): UriInterface
218218
throw new \LogicException(sprintf('You cannot use "%s()" as the "nyholm/psr7" package is not installed. Try running "composer require nyholm/psr7".', __METHOD__));
219219
}
220220

221+
public function __sleep()
222+
{
223+
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
224+
}
225+
226+
public function __wakeup()
227+
{
228+
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
229+
}
230+
221231
public function __destruct()
222232
{
223233
$this->wait();

‎src/Symfony/Component/HttpClient/Response/ResponseTrait.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,16 @@ public function toStream(bool $throw = true)
199199
return $stream;
200200
}
201201

202+
public function __sleep()
203+
{
204+
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
205+
}
206+
207+
public function __wakeup()
208+
{
209+
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
210+
}
211+
202212
/**
203213
* Closes the response and all its network handles.
204214
*/

‎src/Symfony/Component/Mailer/Transport/Smtp/SmtpTransport.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -340,6 +340,16 @@ private function checkRestartThreshold(): void
340340
$this->restartCounter = 0;
341341
}
342342

343+
public function __sleep()
344+
{
345+
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
346+
}
347+
348+
public function __wakeup()
349+
{
350+
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
351+
}
352+
343353
public function __destruct()
344354
{
345355
$this->stop();

‎src/Symfony/Component/Mime/Part/DataPart.php

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,13 @@ public function __wakeup()
155155
$r->setValue($this, $this->_headers);
156156
unset($this->_headers);
157157

158+
if (!\is_array($this->_parent)) {
159+
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
160+
}
158161
foreach (['body', 'charset', 'subtype', 'disposition', 'name', 'encoding'] as $name) {
162+
if (null !== $this->_parent[$name] && !\is_string($this->_parent[$name])) {
163+
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
164+
}
159165
$r = new \ReflectionProperty(TextPart::class, $name);
160166
$r->setAccessible(true);
161167
$r->setValue($this, $this->_parent[$name]);

0 commit comments

Comments
 (0)
0