Repository navigation
Add allowedClasses option to UnserializeCast - #1220
Merged
rubenvanassche merged 2 commits intoOct 26, 2026
Merged
Conversation
rubenvanassche
force-pushed
the
rubenvanassche/spatie-laraveldata-unserialize-rce
branch
from
October 26, 2026 09:05
79effe4 to
0293c73
Compare
rubenvanassche
force-pushed
the
rubenvanassche/spatie-laraveldata-unserialize-rce
branch
from
October 26, 2026 09:08
0293c73 to
ee623ff
Compare
albertcht
pushed a commit
to hypervel/data
that referenced
this pull request
Nov 4, 2026
Data objects can now restore values that were stored with serialize(), such as serialized database columns or cache entries, through #[WithCast(UnserializeCast::class)]. The cast can fail silently, leaving the value to the built-in conversion, and allowedClasses limits which classes unserialize() may create. Port of spatie/laravel-data#1220 at main a161f325d5. Hypervel adaptations: - allowedClasses defaults to false, so no objects are restored unless their classes are listed. Spatie allows every class by default, which runs __wakeup() and __destruct() for any class named in the value. Pass true to allow every class. - failSilently no longer turns coroutine cancellation into a failed cast. The restore hooks of allowed classes can suspend, such as SerializesModels querying the database. - The docs cover the allowed classes, including nested ones, and warn against unserializing untrusted data. Their failSilently example lists the class it restores. All upstream UnserializeCast tests are ported, with coverage for the default, a data object restoring only allowed classes, and cancellation during a restore hook. The cast tests, analysis and formatting pass.
albertcht
pushed a commit
to hypervel/docs
that referenced
this pull request
Nov 4, 2026
Data objects can now restore values that were stored with serialize(), such as serialized database columns or cache entries, through #[WithCast(UnserializeCast::class)]. The cast can fail silently, leaving the value to the built-in conversion, and allowedClasses limits which classes unserialize() may create. Port of spatie/laravel-data#1220 at main a161f325d5. Hypervel adaptations: - allowedClasses defaults to false, so no objects are restored unless their classes are listed. Spatie allows every class by default, which runs __wakeup() and __destruct() for any class named in the value. Pass true to allow every class. - failSilently no longer turns coroutine cancellation into a failed cast. The restore hooks of allowed classes can suspend, such as SerializesModels querying the database. - The docs cover the allowed classes, including nested ones, and warn against unserializing untrusted data. Their failSilently example lists the class it restores. All upstream UnserializeCast tests are ported, with coverage for the default, a data object restoring only allowed classes, and cancellation during a restore hook. The cast tests, analysis and formatting pass.
freekmurze
deleted the
rubenvanassche/spatie-laraveldata-unserialize-rce
branch
November 5, 2026 10:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an
allowedClassesoption toUnserializeCast, which is passed tounserialize()to limit which classes can be created. The default staystrue, so existing behaviour does not change.The cast was not documented yet, so this also adds a section to the casts docs explaining how to use it and noting that it should not be used on user input.