facebook / facebook/hhvm

HHVM incorrectly returns a "valid" (but not initialized) object from a broken serialization string

Open
#6,032 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
18.7k
Forks
3.1k
Avg merge
1h 47m
Merged PRs (30d)
2

Description

I am working on a driver for MongoDB, mimicking the same API as one for PHP. In our extension, we have a couple of built-in classes, that we don't want to serialize (or inherit from). We can signal that by setting class handlers for serialize and unserialize:

```
ce->ce_flags |= ZEND_ACC_FINAL_CLASS;
ce->serialize = zend_class_serialize_deny;
ce->unserialize = zend_class_unserialize_deny;
```

`zend_class_serialize_deny` and `zend_class_unserialize_deny` both throw an exception in the case such an object are attempted to be serialized or deserialized:

```
ZEND_API int zend_class_serialize_deny(zval *object, unsigned char **buffer, zend_uint *buf_len, zend_serialize_data *data TSRMLS_DC) /* {{{ */
{
zend_class_entry *ce = Z_OBJCE_P(object);
zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Serialization of '%s' is not allowed", ce->name);
return FAILURE;
}
```

I was attempting to do imitate the same behaviour with HHVM, by creating a trait:

```
trait NoSerialize {
public function __sleep()
{
throw Exception("Serialization of '" . get_class($this) . "' is not allowed");
}

public function __wakeUp()
{
throw Exception("Unserialization of '" . get_class($this) . "' is not allowed");
}
}
```

But the methods are never called, and HHVM insists on just throwing a warning: `Warning: Attempted to serialize unserializable builtin class MongoDB\Driver\Manager in`

This happens because of https://github.com/facebook/hhvm/blob/HHVM-3.9/hphp/runtime/base/object-data.cpp#L855

(In master, it is now at https://github.com/facebook/hhvm/blob/master/hphp/runtime/base/variable-serializer.cpp#L1517)

It will always do this, unless `isCppSerializable` is part of the class info flags, which I don't seem to be able to set myself.

So the question is really:
- How do I make HHVM throw the same exceptions as PHP?
- Or, how do I set a class info flag of IsCppSerializable for my HNI classes (https://github.com/10gen-labs/mongo-hhvm-driver-prototype/blob/master/ext_mongodb.php#L157)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.