Req #70429 [NEW]: unserialize() should trigger an exception instead of error

From: david dot proweb at gmail dot com Operating system: PHP version: Next Minor Version Package: Scripting Engine problem Bug Type: Feature/Change Request Bug description:unserialize() should trigger an exception instead of error Description: ------------ It can be solved with the error control operator, but seems bad. In general terms, we can consider throws an exception. So it can be handled in correct way. But we have others options. 0. Currently: $data = @unserialize($serialized); Good: very simple; Bad: no real error control, why it failed? 1. Exception: try { $data = unserialize($serialized); } catch (Exception $e) { ... } Good: it can be catched; Bad: it can cause breaking changes (requires major version upgrade); 2. Return false: $data = unserialize('invalid'); $data === false; Good: simple way to catch; Bad: it can be confused with a valid serialize(false); └ But: it should not be a problem, currently you have not a error control for that; 3. Set reference parameter in case of error: $data = unserialize('invalid', $options, $error); if (!$error) { ... } Good: not too good, but should avoid the previous problem; Bad: it'll be the third parameter (PHP7 implements $options as 2nd); 4. Add a new option to choice between solutions1, 2 and maybe 3, and current mode: $data = unserialize('invalid', [ 'errorMode' => PHP_UNSERIALIZE_ERROR, // default/current 'errorMode' => PHP_UNSERIALIZE_EXCEPTION, // solution 1 'errorMode' => PHP_UNSERIALIZE_FALSE, // solution 2 'errorMode' => PHP_UNSERIALIZE_PARAM, // solution 3 // This should set the error to this reference. // If errorMode is not set, it'll change it to PHP_UNSERIALIZE_PARAM. // If errorMode is different of PHP_UNSERIALIZE_PARAM and it is set, errorMode is prioritized. 'errorReference' => &$error, ]); Good: it's flexible; Bad: not too bad, but seems no much efficient; 5. Create a new function to check first if serialized is valid: $data = null; if (is_serialized($data)) { $data = unserialize($data); } Good: is more intuitive; Bad: is more exhaustive to code and to process; └ But: on call is_serialized() the $data should be parsed. It can be processed too and reutilized by unserialize(), that *generally* should be called after validate. 6. Create a new function that can use one of solutions here (1, 2, maybe 3 and 4): $data = serialize_decode('invalid'); // Exception, false, ... $data = serialize_decode(serialize(true)); // OK -- Edit bug report at https://bugs.php.net/bug.php?id=70429&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70429&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70429&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70429&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70429&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70429&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70429&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70429&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70429&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70429&r=support Expected behavior: https://bugs.php.net/fix.php?id=70429&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70429&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70429&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70429&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70429&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70429&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70429&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70429&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70429&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70429&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70429&r=mysqlcfg