Re: [PHP-DEV] [Bug #68319] unserialize() with modified class definition.

2016-06-23 Thread Stanislav Malyshev
Hi! > Looking into the number of unserialize() related "security" issues, I > think we should fix all of them once and forever, introducing a > validation pass. > > In case something in provided data is wrong (e.g. duplicated properties > or array keys, unexpected types, invalid references, inval

Re: [PHP-DEV] [Bug #68319] unserialize() with modified class definition.

2016-06-23 Thread Dmitry Stogov
Looking into the number of unserialize() related "security" issues, I think we should fix all of them once and forever, introducing a validation pass. In case something in provided data is wrong (e.g. duplicated properties or array keys, unexpected types, invalid references, invalid property vis