security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas)

nicolas-grekas · nicolas-grekas · commit 4aa44ecbfb5e · 2019-04-16T12:01:26.000+02:00
This PR was merged into the 2.8 branch. Discussion ---------- [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized | Q | A | ------------- | --- | Branch? | 2.8 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | - Commits ------- 908b64d17e [2.8][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized - CVE-2019-10912
diff --git a/SymfonyTestsListener.php b/SymfonyTestsListener.php
@@ -61,6 +61,16 @@ public function __construct(array $mockedNamespaces = array())
         }
     }
 
+    public function __sleep()
+    {
+        throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
+    }
+
+    public function __wakeup()
+    {
+        throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
+    }
+
     public function __destruct()
     {
         if (0 < $this->state) {

Original file line number	Diff line number	Diff line change
`@@ -61,6 +61,16 @@ public function __construct(array $mockedNamespaces = array())`
`61`	`61`	`}`
`62`	`62`	`}`
`63`	`63`
	`64`	`+ public function __sleep()`
	`65`	`+ {`
	`66`	`+ throw new \BadMethodCallException('Cannot serialize '.__CLASS__);`
	`67`	`+ }`
	`68`	`+`
	`69`	`+ public function __wakeup()`
	`70`	`+ {`
	`71`	`+ throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);`
	`72`	`+ }`
	`73`	`+`
`64`	`74`	`public function __destruct()`
`65`	`75`	`{`
`66`	`76`	`if (0 < $this->state) {`