Re: Re: Bug 67072 resolution for 5.4/5.5

Hi! > *sane* doesn't mean everyone. > Allowing un-serializing data coming from user input is as bad as > eval(), and trying to defend from it is also quite useless. I would like to hear some justification for this claim. > Assuming this exists in the user's codebase: > > class Prank implements Serializable > { > public function serialize() {} > public function unserialize() { exec('rm -rf /'); } > } That one fat assumption. Who would put such code in the codebase? With the same argument you can claim HTTP protocol has a RCE built it, of course "assuming" your http server has exec('rm -rf /'); in it ready to be called. That's not what RCE means. RCE means code execution *without* specially crafted code that is actually written on the server in order to facilitate the exact problem. > Other interesting security issues are related to this as well in my > opinion, but I'd have to do research on the problem first. If you can demonstrate a real RCE or any other problem using unserialize() (besides the __dtor issue which is widely known along with its mitigation) please share it with me or security@php.net. Those happen, as any other bugs, but claim that unserialize() is the same as eval() seems to be over-reaching. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/