Automattic / Automattic/go-search-replace
Corrupted data if serialized var contains a serialized string that gets changed
- Dominant language
- Go
- Stars
- 108
- Forks
- 19
- PR merge metrics
- No merged PRs in 30d
Description
It is an edge case and the first time I've seen/noticed it so I don't expect a fix, and it's probably out of scope for this tool, but since I ran into it:
Having
```
serialize([ 'something' => 'a:1:{s:3:"url";s:20:"https://example.org/";}'])
```
and replacing the domain:
```
echo 'a:1:{s:4:\"test\";s:44:\"a:1:{s:3:\"url\";s:20:\"https://example.org/\";}\";}' | ./go-search-replace_linux_amd64 example.org test.com
```
yields
```
a:1:{s:4:\"test\";s:44:\"a:1:{s:3:\"url\";s:17:\"https://test.com/\";}\";}
```
when it should be
```
a:1:{s:4:\"test\";s:41:\"a:1:{s:3:\"url\";s:17:\"https://test.com/\";}\";}
```
because the length only gets fixed in the "inner" string. I don't see an easy fix with the way it's currently built because you'd have to backtrack all the way to the beginning to be sure that you're not inside a nested serialization, but maybe I'm missing something.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the nested serialized-string example with ./go-search-replace_linux_amd64 and compare the resulting outer and inner length fields. Trace the search-and-replace entry point to determine how serialized lengths are updated; done would mean nested serialized data remains valid after replacement, or the limitation is explicitly documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, sql
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100