Add safe wrapper for unserialize#720
Conversation
|
I've approved the automated test workflows to run, but github seems confused (and also another couple of big changes got merged) -- can you rebase and re-push and hopefully then the tests will all run and pass? |
b19cd5e to
055564b
Compare
|
Yeah, I think Github actions was suffering a major outage yesterday. Rebased and re-pushed. I see that support for PHP 8.6 has been one of the changes merged into master, should I also re-run the generate script to update |
Yes please ❤️ (Also the deduplication patch was also merged, so 8.6/functionlist might not exist if it happens to be identical to 8.5/functionlist -- but the tests say something is out of sync either way ^^) |
055564b to
174e50b
Compare
Awesome! Done, it seems things are on sync now. |
This is my first contribution to this repository, feedback is appreciated.
PHP default behavior for strings that cannot be unserialized is to return a false and emit an E_WARNING (or E_NOTICE depending on PHP version).
This wrapper tries to guarantee that something like that will in fact throw an
ErrorExceptionby setting a custom error handler, executing the function, and then restoring it to its previous state.I believe this is necessary because there is a scenario where an unserialize call, although successful, returns a false because the previous serialized value was indeed a false boolean, and not because an error happened during unserialization.