Re: [RFC][Discussion] NotSerializable attribute

On 12/9/23 17:28, Larry Garfield wrote: > On Sat, Dec 9, 2023, at 10:17 AM, Niels Dossche wrote: >> Hi Max >> >> On 12/9/23 13:30, Max Semenik wrote: >>> Hi, I'd like to propose a new attribute, #[NotSerializable]. This >>> functionality is already available for internal classes - userspace should >>> benefit from it, too. >>> >>> The RFC: https://wiki.php.net/rfc/not_serializable >>> Proposed implementation: >>> https://github.com/php/php-src/pull/12788 >>> >>> Please let me know what you think. >>> >> >> Thanks for this proposal, it is a sensible addition in my opinion. >> >> I do have a question/remark though. >> The example you wrote in your RFC (with MyClass implementing __sleep >> and __awake) is not equivalent to adding #[NotSerializable]. >> This is because if you create a child class of MyClass: >> >> ``` >> class MyClassChild extends MyClass >> { >> public function __sleep(): array >> { >> return ...; // real implementation instead of throwing >> } >> >> public function __wakeup(): void >> { >> ... // real implementation instead of throwing >> } >> } >> ``` >> >> Then this subclass MyClassChild will actually be serializable. >> If you instead put #[NotSerializable] on the parent class MyClass, then >> the child class won't be serializable even if you implement the >> serialization methods in the child. >> Is this intentional? If yes, this should probably be clarified in the >> text. > > Attributes do not inherit automatically, so it's the opposite. A child that is not marked > #[NotSerializable] would be serializable. (Whether that's good or not is a separate question.) > I know attributes aren't inherited, but the ZEND_ACC flag that this uses _is_ inherited. Try this out yourself: ``` <?php #[NotSerializable] class MyClass {} class Foo extends MyClass {} $foo = new Foo(); $serialized = serialize($foo); ``` Results in Fatal error: Uncaught Exception: Serialization of 'Foo' is not allowed > > --Larry Garfield >