SafeUnserialize
in package
Reads legacy PHP-serialized columns/session values that are expected to hold only arrays and scalars (e-mail queue reply-tos/files, favourites, asset variants).
Never instantiates classes (allowed_classes => false) and rejects the whole
payload when it contains any object, so a tampered value cannot reach a gadget
nor break callers that index items as arrays.
Table of Contents
Constants
- MAX_DEPTH : int = 8
- Deepest allowed nesting; real payloads (email queue, favourites, asset variants) have 2-3 levels.
- MAX_NODES : int = 10000
- Node count cap; otherwise cyclic references (`R:`/`r:`) expand a small payload into a huge tree.
Methods
- toArray() : array<string|int, mixed>
- toIntList() : array<int, int>
- Unserializes a list of integer IDs; non-integer items are dropped.
- containsObject() : bool
- Returns true when the payload must be discarded.
Constants
MAX_DEPTH
Deepest allowed nesting; real payloads (email queue, favourites, asset variants) have 2-3 levels.
private
int
MAX_DEPTH
= 8
MAX_NODES
Node count cap; otherwise cyclic references (`R:`/`r:`) expand a small payload into a huge tree.
private
int
MAX_NODES
= 10000
Methods
toArray()
public
static toArray(string|null $value) : array<string|int, mixed>
Parameters
- $value : string|null
Return values
array<string|int, mixed>toIntList()
Unserializes a list of integer IDs; non-integer items are dropped.
public
static toIntList(string|null $value) : array<int, int>
Parameters
- $value : string|null
Return values
array<int, int>containsObject()
Returns true when the payload must be discarded.
private
static containsObject(array<string|int, mixed> $data, int $depth, int &$nodes) : bool
That is the case when it contains an object, is deeper than MAX_DEPTH (cyclic
reference a:1:{i:0;R:1;}) or has more than MAX_NODES nodes.
Parameters
- $data : array<string|int, mixed>
- $depth : int
- $nodes : int