Metadata

ID: php-security/avoid-unserialize

Language: PHP

Severity: Notice

Category: Security

CWE: 502

Description

This rule warns against the use of the unserialize function without specifying allowed classes. Using unserialize on untrusted data can lead to serious security vulnerabilities, such as object injection attacks, which may allow attackers to execute arbitrary code or manipulate your application’s state.

To ensure safe usage, always provide the allowed_classes option when calling unserialize. This restricts the types of objects that can be instantiated during deserialization and helps prevent malicious payloads from being executed. For example, use unserialize like this: unserialize($input, ['allowed_classes' => ['stdClass', 'MyDataClass']]);. This approach enforces strict control over which classes are allowed, minimizing security risks while still enabling object deserialization when necessary.

Non-Compliant Code Examples

<?
$object = unserialize($input);
?>

Compliant Code Examples

<?
$object = unserialize($input, ['allowed_classes' => ['stdClass', 'MyDataClass']]);
?>

Integraciones sin problemas. Prueba Datadog Code Security

Datadog Code Security