Fix: allow stdClass by default, use custom class in hook test scenario

Agent-Logs-Url: https://github.com/wp-cli/search-replace-command/sessions/599c39d4-de3e-4bc3-a371-0e93ec6c6a78

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Author: Copilot

features/search-replace.feature

@@ -1207,19 +1207,22 @@ Feature: Do global search/replace
   Scenario: The search_replace_unserialize_options hook allows overriding allowed_classes for unserialize
 
     Given a WP install
-    And I run `wp option add cereal_isation 'O:8:"stdClass":1:{s:3:"foo";s:13:"cereal_marker";}'`
+    And I run `wp db query "INSERT INTO wp_options (option_name,option_value) VALUES ('cereal_isation','O:7:\"MyClass\":1:{s:3:\"foo\";s:13:\"cereal_marker\";}')"`
     And a hook.php file:
       """
       <?php
+      class MyClass {
+        public $foo = '';
+      }
       WP_CLI::add_hook( 'search_replace_unserialize_options', function() {
-        return [ 'allowed_classes' => [ 'stdClass' ] ];
+        return [ 'allowed_classes' => [ 'stdClass', 'MyClass' ] ];
       } );
       """
 
     When I try `wp search-replace cereal_marker cereal_replaced`
     Then STDERR should contain:
       """
-      Warning: Skipping an uninitialized class "stdClass", replacements might not be complete.
+      Warning: Skipping an uninitialized class "MyClass", replacements might not be complete.
       """
     And STDOUT should contain:
       """

src/WP_CLI/SearchReplacer.php

@@ -103,13 +103,14 @@ public function __construct( $from, $to, $recurse_objects = false, $regex = fals
 		/**
 		 * Filter the options passed to unserialize() during search-replace.
 		 *
-		 * Defaults to `[ 'allowed_classes' => false ]` to prevent instantiation
-		 * of arbitrary classes as a hardening measure. Use this hook to allow
-		 * specific classes when needed.
+		 * Defaults to `[ 'allowed_classes' => [ 'stdClass' ] ]` to allow the
+		 * built-in stdClass (used extensively by WordPress, e.g. theme mods)
+		 * while blocking arbitrary user-defined class instantiation. Use this
+		 * hook to allow additional classes when needed.
 		 *
 		 * @param array<string, mixed> $options Options array for unserialize().
 		 */
-		$this->unserialize_options = \WP_CLI::do_hook( 'search_replace_unserialize_options', [ 'allowed_classes' => false ] );
+		$this->unserialize_options = \WP_CLI::do_hook( 'search_replace_unserialize_options', [ 'allowed_classes' => [ 'stdClass' ] ] );
 	}
 
 	/**