Changeset 49382

Timestamp:

10/29/2020 05:58:49 PM (3 years ago)

Author:

desrosj

Message:

External Libraries: Disable deserialization in Requests_Utility_FilteredIterator

Props xknown, peterwilsoncc, desrosj, dd32, whyisjake.
Merges [49373] to trunk.

Location:

trunk

Files:

• . (modified) (1 prop)
• src/wp-includes/Requests/Utility/FilteredIterator.php (modified) (1 diff)
• tests/phpunit/tests/functions.php (modified) (1 diff)

trunk/src/wp-includes/Requests/Utility/FilteredIterator.php

@@ -43 +43 @@
         return $value;
     }
+
+    /**
+     * @inheritdoc
+     */
+    public function unserialize( $serialized ) {
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function __unserialize( $serialized ) { // phpcs:ignore PHPCompatibility.FunctionNameRestrictions.ReservedFunctionNames.MethodDoubleUnderscore,PHPCompatibility.FunctionNameRestrictions.NewMagicMethods.__unserializeFound
+    }
+
+    public function __wakeup() { // phpcs:ignore PHPCompatibility.FunctionNameRestrictions.ReservedFunctionNames.MethodDoubleUnderscore,PHPCompatibility.FunctionNameRestrictions.NewMagicMethods.__wakeupFound
+        unset( $this->callback );
+    }
 }

trunk/tests/phpunit/tests/functions.php

@@ -268 +268 @@
     function test_is_serialized( $value, $expected ) {
         $this->assertSame( $expected, is_serialized( $value ) );
+    }
+
+    /**
+     * @dataProvider data_serialize_deserialize_objects
+     */
+    function test_deserialize_request_utility_filtered_iterator_objects( $value ) {
+        $serialized = maybe_serialize( $value );
+        if ( get_class( $value ) === 'Requests_Utility_FilteredIterator' ) {
+            $new_value = unserialize( $serialized );
+            if ( version_compare( PHP_VERSION, '5.3', '>=' ) ) {
+                $property = ( new ReflectionClass( 'Requests_Utility_FilteredIterator' ) )->getProperty( 'callback' );
+                $property->setAccessible( true );
+                $callback_value = $property->getValue( $new_value );
+                $this->assertSame( null, $callback_value );
+            } else {
+                $current_item = @$new_value->current(); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                $this->assertSame( null, $current_item );
+            }
+        } else {
+            $this->assertEquals( $value->count(), unserialize( $serialized )->count() );
+        }
+    }
+
+    function data_serialize_deserialize_objects() {
+        return array(
+            array( new Requests_Utility_FilteredIterator( array( 1 ), 'md5' ) ),
+            array( new Requests_Utility_FilteredIterator( array( 1, 2 ), 'sha1' ) ),
+            array( new ArrayIterator( array( 1, 2, 3 ) ) ),
+        );
     }