Bug #74687 [Com]: __wakeup called for nested serialized object after Serializable::unserialize

Edit report at https://bugs.php.net/bug.php?id=74687&edit=1 ID: 74687 Comment by: taco at procurios dot nl Reported by: taco at procurios dot nl Summary: __wakeup called for nested serialized object after Serializable::unserialize Status: Duplicate Type: Bug Package: Unknown/Other Function Operating System: linux PHP Version: 5.6.30 Block user comment: N Private report: N New Comment: Reading the comments of #70213 it seems that the security issue was fixed in another bug fix. Is #70213 really a security fix or should it be reviewed more closely? In practice the current change in behavior makes it impossible to use the __wakeup method, since (in large projects and/or frameworks) there is no way to tell whether or not an object will be unserialized within a unserialize method. Previous Comments: ------------------------------------------------------------------------ [2017-06-01 10:02:46] nikic@php.net Duplicate of bug #74436. TL;DR is that this is an intentional change due to a security fix. We haven't found a way to address both the security issues this fixes and preserve the existing behavior. ------------------------------------------------------------------------ [2017-06-01 09:55:53] taco at procurios dot nl Description: ------------ When an object is unserialized within the unserialize method of a Serializable implementation, its __wakeup method will be called _after_ the unserialize call is finished, making the object invalid during the unserialize call. Most likely (based on the changelogs of the first affected php versions) this behaviour was introduced by the fix for this bug: https://bugs.php.net/bug.php?id=70213 Test script: --------------- Problem: https://3v4l.org/MlbuO .phpt file: https://gist.githubusercontent.com/tacovandenbroek/0ed29d1a449c57dfb4335d1ec4b00cae/raw/42fdc427521969f0affe719cf84f829098824ba0/php%20__wakeup%20bug.phpt ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74687&edit=1