Re: JSON inclusion in core
| From: | Lukas Smith | Date: | Sat, 21 Jan 2006 16:05:22 +0000 |
| Subject: | Re: JSON inclusion in core | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-21625@lists.php.net to get a copy of this message | ||
Andi Gutmans wrote:
At 04:25 AM 1/21/2006, Jared Williams wrote:Maybe we should try to come up with a common approach here for unserialize() as well? regards, LukasWhat are the security implications of doing this? Creating objects based on a string from a untrusted source seems not good idea, unless can prevent tampering (with an HMAC or something).Well I think the right thing to do is pass an array of "allowed" classes into json_decode() and raise an error/exception if it's not in the list.