Skip to content

Commit 9090afd

Browse files
committed
Fix GH-21682: ZipArchive is missing the NOT_SERIALIZABLE flag
ZipArchive allowed serialization, producing a string that unserializes into an empty object with no open file handle. Add the @not-serializable annotation so serialize() throws an exception. Closes GH-21682
1 parent 57d6d71 commit 9090afd

File tree

3 files changed

+19
-2
lines changed

3 files changed

+19
-2
lines changed

ext/zip/php_zip.stub.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ function zip_entry_filesize($zip_entry): int|false {}
6464
#[\Deprecated(since: '8.0', message: 'use ZipArchive::statIndex() instead')]
6565
function zip_entry_compressionmethod($zip_entry): string|false {}
6666

67+
/** @not-serializable */
6768
class ZipArchive implements Countable
6869
{
6970
/**

ext/zip/php_zip_arginfo.h

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

ext/zip/tests/gh21682.phpt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
GH-21682 (ZipArchive is missing the NOT_SERIALIZABLE flag)
3+
--EXTENSIONS--
4+
zip
5+
--FILE--
6+
<?php
7+
$a = new ZipArchive();
8+
try {
9+
serialize($a);
10+
echo "ERROR: should have thrown\n";
11+
} catch (\Exception $e) {
12+
echo $e->getMessage() . "\n";
13+
}
14+
?>
15+
--EXPECT--
16+
Serialization of 'ZipArchive' is not allowed

0 commit comments

Comments
 (0)