NotificationsYou must be signed in to change notification settings
Fork9.7k
Star30.8k

[Security] Unserialize $parentData, if needed, to avoid errors#36862

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

nicolas-grekas merged 1 commit intosymfony:4.4fromrfaivre:ticket_36813

May 18, 2020

Merged

[Security] Unserialize $parentData, if needed, to avoid errors#36862

nicolas-grekas merged 1 commit intosymfony:4.4fromrfaivre:ticket_36813

May 18, 2020

Conversation

Copy link

Contributor

rfaivre commentedMay 18, 2020

Check that the $parentData is an array. If it's a string, the variable is unserialized.
Useful to not break the compatibility with the older versions.
Bug reproduced when upgrading from 3.4 to 4.4

Q	A
Branch?	4.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	Fix#36813
License	MIT
Doc PR	symfony/symfony-docs#...

carsonbot added Status: Needs Review Security Bug labels

May 18, 2020

nicolas-grekas added this to the4.4 milestone

May 18, 2020

Copy link

Member

nicolas-grekas commentedMay 18, 2020

Should we need the same for these?

$ grep 'parent::__unserialize' * -rCore/Tests/Authentication/Token/AbstractTokenTest.php:        parent::__unserialize($parentState);Core/Tests/Exception/CustomUserMessageAuthenticationExceptionTest.php:        parent::__unserialize($parentData);Core/Authentication/Token/AbstractToken.php:     *         parent::__unserialize($parentData);Core/Authentication/Token/SwitchUserToken.php:        parent::__unserialize($parentData);Core/Authentication/Token/PreAuthenticatedToken.php:        parent::__unserialize($parentData);Core/Authentication/Token/RememberMeToken.php:        parent::__unserialize($parentData);Core/Authentication/Token/UsernamePasswordToken.php:        parent::__unserialize($parentData);Core/Authentication/Token/AnonymousToken.php:        parent::__unserialize($parentData);Core/Exception/UsernameNotFoundException.php:        parent::__unserialize($parentData);Core/Exception/AccountStatusException.php:        parent::__unserialize($parentData);Core/Exception/AuthenticationException.php:     *         parent::__unserialize($parentData);Core/Exception/CustomUserMessageAuthenticationException.php:        parent::__unserialize($parentData);Core/Exception/CustomUserMessageAccountStatusException.php:        parent::__unserialize($parentData);Guard/Token/PostAuthenticationGuardToken.php:        parent::__unserialize($parentData);Http/Authenticator/Token/PostAuthenticationToken.php:        parent::__unserialize($parentData);