Re: Re: WDDX serialization and security
| From: | Stanislav Malyshev | Date: | Sun, 13 Aug 2017 15:43:06 +0000 |
| Subject: | Re: Re: WDDX serialization and security | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-100200@lists.php.net to get a copy of this message | ||
Hi!
> IMHO, implementing support for objects has been a most unfortunate
> decision, because WDDX was indeed not designed for that
> (<http://xml.coverpages.org/wddx0090-dtd-19980928.txt>).
> Considering
> https://bugs.php.net/bug.php?id=75044 makes the situation
> worse.
>
Agreed, and it was also implemented as a horrible and undocumented hack
:( I wonder if we could drop support for objects from it? Maybe it'd be
better than dropping the whole thing? I don't know, we need to ask
somebody who actually uses it, and I have no idea who those are...
--
Stas Malyshev
smalyshev@gmail.com