Re: SensitiveParameterValue serialization behavior

Hi Guilliam, On 2/25/22 13:11, Guilliam Xavier wrote:

I would prefer option 2 (if possible), to avoid potentially breaking existing code.

Sure, that's possible. Otherwise I wouldn't have proposed it :-) The solution for this is simply an additional private property $isPoisoned that is set to true when unserializing. If it is true, ->getValue() will throw an exception.

Calls to ->getValue() will be in new code written specifically for SensitiveParameterValue anyway, and can be wrapped into try-catch, I think?

Yes, try-catch works. I theoretically could add an additional public function isPoisoned(): bool as well. The user should likely already know whether the SensitiveParameterValue came from unserialized data or not, though. Best regards Tim Düsterhus Developer WoltLab GmbH -- WoltLab GmbH Nedlitzer Str. 27B 14469 Potsdam Tel.: +49 331 96784338 duesterhus@woltlab.com www.woltlab.com Managing director: Marcel Werk AG Potsdam HRB 26795 P