Automattic / Automattic/go-search-replace

Corrupted data if serialized var contains a serialized string that gets changed

Open
#38 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
108
Forks
19
PR merge metrics
No merged PRs in 30d

Description

It is an edge case and the first time I've seen/noticed it so I don't expect a fix, and it's probably out of scope for this tool, but since I ran into it:
Having
```
serialize([ 'something' => 'a:1:{s:3:"url";s:20:"https://example.org/";}'])
```
and replacing the domain:
```
echo 'a:1:{s:4:\"test\";s:44:\"a:1:{s:3:\"url\";s:20:\"https://example.org/\";}\";}' | ./go-search-replace_linux_amd64 example.org test.com
```
yields
```
a:1:{s:4:\"test\";s:44:\"a:1:{s:3:\"url\";s:17:\"https://test.com/\";}\";}
```
when it should be
```
a:1:{s:4:\"test\";s:41:\"a:1:{s:3:\"url\";s:17:\"https://test.com/\";}\";}
```
because the length only gets fixed in the "inner" string. I don't see an easy fix with the way it's currently built because you'd have to backtrack all the way to the beginning to be sure that you're not inside a nested serialization, but maybe I'm missing something.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the nested serialized-string example with ./go-search-replace_linux_amd64 and compare the resulting outer and inner length fields. Trace the search-and-replace entry point to determine how serialized lengths are updated; done would mean nested serialized data remains valid after replacement, or the limitation is explicitly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, sql
Domain
tooling
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.