polyfill-unserialize icon indicating copy to clipboard operation
polyfill-unserialize copied to clipboard

Published 20 hours ago • verified publisher icon dbrumann
→

Metadata

Backports unserialize options introduced in PHP 7.0 to older PHP versions.

Results 1 polyfill-unserialize issues
Sort by recently updated
recently updated
newest added

Prevent circumvention via specially crafted serialized string

According to upstream sources a sign (`+`, `-`) is accepted before the length: https://github.com/php/php-src/blob/PHP-5.4.45/ext/standard/var_unserializer.re#L260-L266 So it is possible to circumvent the polyfill by manually adding it, i.e.: `O:9:"Exception"` vs `O:+9:"Exception"`

huncrys avatar huncrys

← Metadata

35
Stars
2
Forks
Watchers

Owner

verified publisher icon dbrumann

Metadata

Backports unserialize options introduced in PHP 7.0 to older PHP versions.

Back