Re: Unserialize security policy

> On 2 Aug 2017, at 23:03, Nikita Popov <nikita.ppv@gmail.com> wrote: > > Hi, > > https://bugs.php.net/bug.php?id=75006 has been marked as a > non-security > bug, with the justification that unserialize() should not be fed untrusted > input. While we do document that unserialize() shouldn't be used on > untrusted input, we have always treated these as security bugs in the past. > Correct, which was a mistake long overdue for fixing. Treating unserialoze issues as security creates the false sense that we expect it to be secure, when we absolutely don't. We'll continue fixing these bugs of course, But after discussing it on the security mailing list, we decided to finally stop treating those as security issues. Unserialize is inherently insecure, people should know it and act accordingly. It may be worth a note in the ChangeLog to make it a bit more prominent.