Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

allow unserialize all classes #2

Merged
merged 1 commit into from
Oct 24, 2018
Merged

allow unserialize all classes #2

merged 1 commit into from
Oct 24, 2018

Conversation

regnerisch
Copy link

I had an issue with this: I saved Objects and on getting them back i got __PHP_Incomplete_Class Error. This will fix it.

@codecov
Copy link

codecov bot commented Oct 22, 2018

Codecov Report

Merging #2 into master will not change coverage.
The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff            @@
##             master       #2   +/-   ##
=========================================
  Coverage     99.46%   99.46%           
  Complexity       78       78           
=========================================
  Files             6        6           
  Lines           187      187           
=========================================
  Hits            186      186           
  Misses            1        1
Impacted Files Coverage Δ Complexity Δ
src/FilesystemPool.php 98.24% <100%> (ø) 23 <0> (ø) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0177054...f131295. Read the comment docs.

@duncan3dc
Copy link
Owner

Hi @Tera3yte, thanks for your contribution but that's not the best fix for your issue, as it opens up a security risk.

Do you have a short script to reproduce the problem you were seeing?

@duncan3dc duncan3dc added the bug label Oct 23, 2018
@regnerisch
Copy link
Author

regnerisch commented Oct 24, 2018

$adapter = new \Http\Adapter\Guzzle6\Client();
$provider = new \Geocoder\Provider\GoogleMaps\GoogleMaps($adapter, 'en', 'GOOGLE_MAPS_KEY');
$providerCache = new \Geocoder\Provider\Cache\ProviderCache($provider, new \duncan3dc\Cache\FilesystemPool(__DIR__ . '/cache'));
$geocoder = new \Geocoder\StatefulGeocoder($providerCache, 'en');

$result = $geocoder->geocodeQuery(\Geocoder\Query\GeocodeQuery::create(sprintf('%s %s %s %s %s',
           'address_line_1',
           'address_line_2',
           'postcode',
           'city',
           'country'
        )));

This Code saves .cache-Files as:

O:20:"duncan3dc\Cache\Item":3:{s:25:"\00duncan3dc\Cache\Item\00key";s:42:"v4a2b8c22810b6846a69686ab8ad6f15a772380ab2";s:27:"\00duncan3dc\Cache\Item\00value";O:32:"Geocoder\Model\AddressCollection":1:{s:43:"\00Geocoder\Model\AddressCollection\00locations";a:1:{i:0;O:48:"Geocoder\Provider\GoogleMaps\Model\GoogleAddress":29:{s:52:"\00Geocoder\Provider\GoogleMaps\Model\GoogleAddress\00id";s:103:"SOME_RANDOM_STRING";s:62:"\00Geocoder\Provider\GoogleMaps\Model\GoogleAddress\00locationType";s:7:"ROOFTOP";s:60:"\00Geocoder\Provider\GoogleMaps\Model\GoogleAddress\00resultType";a:1:{i:0;s:10:"subpremise";} [...]

And on trying to get the Cache Item Back the Script fails because of the __PHP_Incomplete_Class. I'm sure this problem will occur on every object-value.

@duncan3dc
Copy link
Owner

That's great @Tera3yte thanks. It looks like there's no reasonable way around this and the onus has to be on library consumers to ensure they are protected their cache data securely.

@duncan3dc duncan3dc merged commit f91b52e into duncan3dc:master Oct 24, 2018
@regnerisch regnerisch deleted the patch/unserialize-allow-all-classes branch October 24, 2018 13:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants