PHP手冊中從5.5升級到5.6 unserialize的變更是這樣寫的：
unserialize() will now fail if passed serialised data that has been manipulated to attempt to instantiate an object without calling its constructor.
英文比較差想知道是什么意思，傳入的數據是序列化過的沒有調用過constructor的對象？
我度過這樣的代碼，但沒報錯：
class A{
}
$reClass = new ReflectionClass('A');
$b = $reClass->newInstanceWithoutConstructor();
echo '<pre>';
print_r(unserialize(serialize($reClass)));
die;
1 回答
哈士奇WWW
TA貢獻1799條經驗 獲得超6個贊
這個問題其實是和序列化接口相關的一個修改。
5.6的更新日志里有寫
5.6.0 Manipulating the serialised data by replacing C: with O: to force object instantiation without calling the constructor will now fail.
大意就是說，5.6不允許將修改已經序列化數據中的C:改為O:來避免調用類中生成器。
我們寫一個類來了解這是什么意思，首先我們在PHP5.3中實現一個繼承序列化接口的類
class obj implements Serializable {
public $data;
public function __construct() {
$this->data = "My private data";
}
public function serialize() {
return serialize($this->data);
}
public function unserialize($data) {
echo 'test';
}
}
$test = new obj();
echo serialize($test);//輸出C:3:"obj":23:{s:15:"My private data";}
var_dump(unserialize('C:3:"obj":23:{s:15:"My private data";}'));//調用unserialize方法，輸出test
var_dump(unserialize('O:3:"obj":1:{s:4:"data";s:15:"My private data";}'));//沒有調用unserialize方法，沒有輸出
接下來我們在5.6中實驗相同的代碼
class obj implements Serializable {
public $data;
public function __construct() {
$this->data = "My private data";
}
public function serialize() {
return serialize($this->data);
}
public function unserialize($data) {
echo 'test';
}
}
$test = new obj();
echo serialize($test);//輸出C:3:"obj":23:{s:15:"My private data";}
var_dump(unserialize('C:3:"obj":23:{s:15:"My private data";}'));//調用unserialize方法，輸出test
var_dump(unserialize('O:3:"obj":1:{s:4:"data";s:15:"My private data";}'));//拋出了一個Warning,PHP Warning: Erroneous data format for unserializing 'obj'
所以其實這個更新的意思就是說，不能靠修改序列化的數據，在不調用對象構造器的情況下實例化對象
- 1 回答
- 0 關注
- 536 瀏覽
添加回答
舉報
0/150
提交
取消