archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Use serialize_deny for CURLFile

Browse source 
Instead of a throwing __wakeup() method.
This commit is contained in:
Nikita Popov 2018-11-26 13:20:51 +01:00
parent 43417953f4
commit a624c2bd13
4 changed files with 19 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

4
UPGRADING
View file

@ -19,6 +19,10 @@ PHP 7.4 UPGRADE NOTES
1. Backward Incompatible Changes
========================================
- Curl:
. Attempting to serialize a CURLFile class will now generate an exception.
Previously the exception was only thrown on unserialization.
- Date:
. Calling var_dump() or similar on a DateTime(Immutable) instance will no
longer leave behind accessible properties on the object.

14
ext/curl/curl_file.c
View file

@ -22,6 +22,7 @@
#include "php.h"
#include "Zend/zend_exceptions.h"
#include "Zend/zend_interfaces.h"
#include "php_curl.h"
#if HAVE_CURL
@ -130,16 +131,6 @@ ZEND_METHOD(CURLFile, setPostFilename)
}
/* }}} */
/* {{{ proto CURLFile::__wakeup()
Unserialization handler */
ZEND_METHOD(CURLFile, __wakeup)
{
zend_unset_property(curl_CURLFile_class, ZEND_THIS, "name", sizeof("name")-1);
zend_update_property_string(curl_CURLFile_class, ZEND_THIS, "name", sizeof("name")-1, "");
zend_throw_exception(NULL, "Unserialization of CURLFile instances is not allowed", 0);
}
/* }}} */
ZEND_BEGIN_ARG_INFO_EX(arginfo_curlfile_create, 0, 0, 1)
ZEND_ARG_INFO(0, filename)
ZEND_ARG_INFO(0, mimetype)
@ -158,7 +149,6 @@ static const zend_function_entry curlfile_funcs[] = {
PHP_ME(CURLFile, setMimeType, arginfo_curlfile_name, ZEND_ACC_PUBLIC)
PHP_ME(CURLFile, getPostFilename, NULL, ZEND_ACC_PUBLIC)
PHP_ME(CURLFile, setPostFilename, arginfo_curlfile_name, ZEND_ACC_PUBLIC)
PHP_ME(CURLFile, __wakeup, NULL, ZEND_ACC_PUBLIC)
PHP_FE_END
};
@ -167,6 +157,8 @@ void curlfile_register_class(void)
zend_class_entry ce;
INIT_CLASS_ENTRY( ce, "CURLFile", curlfile_funcs );
curl_CURLFile_class = zend_register_internal_class(&ce);
curl_CURLFile_class->serialize = zend_class_serialize_deny;
curl_CURLFile_class->unserialize = zend_class_unserialize_deny;
zend_declare_property_string(curl_CURLFile_class, "name", sizeof("name")-1, "", ZEND_ACC_PUBLIC);
zend_declare_property_string(curl_CURLFile_class, "mime", sizeof("mime")-1, "", ZEND_ACC_PUBLIC);
zend_declare_property_string(curl_CURLFile_class, "postname", sizeof("postname")-1, "", ZEND_ACC_PUBLIC);

11
ext/curl/tests/bug73147.phpt
View file

@ -11,10 +11,13 @@ if (!extension_loaded("curl")) {
$poc = 'a:1:{i:0;O:8:"CURLFile":1:{s:4:"name";R:1;}}';
try {
var_dump(unserialize($poc));
var_dump(unserialize($poc));
} catch(Exception $e) {
echo $e->getMessage();
echo $e->getMessage();
}
?>
--EXPECT--
Unserialization of CURLFile instances is not allowed
--EXPECTF--
Warning: Erroneous data format for unserializing 'CURLFile' in %s on line %d
Notice: unserialize(): Error at offset 27 of 44 bytes in %s on line %d
bool(false)

11
ext/curl/tests/curl_file_serialize.phpt
View file

@ -8,13 +8,12 @@ if (!extension_loaded("curl")) {
?>
--FILE--
<?php
$data = 'a:2:{s:4:"file";O:8:"CURLFile":3:{s:4:"name";s:13:"testdata1.txt";s:4:"mime";s:0:"";s:8:"postname";s:0:"";}s:4:"data";s:3:"foo";}';
var_dump(unserialize($data));
$file = new CURLFile(__DIR__ . '/curl_testdata1.txt');
var_dump(serialize($file));
?>
--EXPECTF--
Fatal error: Uncaught Exception: Unserialization of CURLFile instances is not allowed in %s
Fatal error: Uncaught Exception: Serialization of 'CURLFile' is not allowed in %s:%d
Stack trace:
#0 [internal function]: CURLFile->__wakeup()
#1 %s
#2 {main}
#0 %s(%d): serialize(Object(CURLFile))
#1 {main}
thrown in %s on line %d