serializer's Introduction

Yii Serializer Library

The package ...

General usage

Unit testing

The package is tested with PHPUnit. To run tests:

./vendor/bin/phpunit

Mutation testing

The package tests are checked with Infection mutation framework. To run it:

./vendor/bin/infection

Static analysis

The code is statically analyzed with Psalm. To run static analysis:

./vendor/bin/psalm

Support the project

Follow updates

License

The Yii Serializer Library is free software. It is released under the terms of the BSD License. Please see LICENSE for more information.

Maintained by Yii Software.

serializer's People

Contributors

Stargazers

Watchers

serializer's Issues

Reconsider the package

There's doubt if the package is needed overall.

Current use cases

Package	Case	Thoughts
data-reponse	`SerializerInterface::serialize()` used in `JsonDataFormatter` and `XmlDataFormatter` to form response from data. `unserialize()` isn't used.	For this case serializer should be as simple/fast as possible. Formatters are concreate so we can possibly have implementation right there not relying on SerializerInterface (in case it's removed).
yii-queue	`SerializerInterface` used to get string representation of job message.	There's `MessageSerializerInterface` so removing support for `SerializerInterface` isn't a big loss.

Implement XML serializer

Can be used by yii-web formatter to convert data into XML.

unserialize() can be exploited to gain RCE

Im sorry Im new here and I dont know where to ask this question but somehow it seems bothering because yii v1 and v2 are using this function especially in handling cookies. I found this link. Can someone explains to me if yii is vulnerable to this kind of attack?

https://www.evonide.com/how-we-broke-php-hacked-pornhub-and-earned-20000-dollar/
https://www.evonide.com/breaking-phps-garbage-collection-and-unserialize/

Recommend Projects