Upgrade to Pro — share decks privately, control downloads, hide ads and more …

知られざるSerialize

 知られざるSerialize

Yuichi Sugiyama

July 31, 2019
Tweet

More Decks by Yuichi Sugiyama

Other Decks in Technology

Transcript

  1. Who am I • ਿࢁ ༞Ұ @oogFranz • αΠϘ΢ζ5೥໨ΤϯδχΞ •

    େاۀ޲͚άϧʔϓ΢ΣΞ Λ࡞ͬͯΔʢPHP 7.2) • ෳۀδϟζϛϡʔδγϟϯ@MASHݭָஂ
  2. serialize() όϦϕϯϦ $a = ["hoge", 3, true]; $a[] = &$a;

    echo serialize($a); # a:4:{i:0;s:4:"hoge";i:1;i:3;i:2;b:1;i:3;a:4: {i:0;s:4:"hoge";i:1;i:3;i:2;b:1;i:3;R:5;}} • PHPͷ஋Λ෮ݩՄೳͳจࣈྻʹม׵͢Δɻ • ΫϥεͷΠϯελϯεͰ͋ͬͯ΋ม׵Մೳʂ • DBʹ΋อଘͰ͖Δʂ΍ͬͨͶʂ
  3. serialize() όϦϕϯϦ $a = ["hoge", 3, true]; $a[] = &$a;

    echo serialize($a); # a:4:{i:0;s:4:"hoge";i:1;i:3;i:2;b:1;i:3;a:4: {i:0;s:4:"hoge";i:1;i:3;i:2;b:1;i:3;R:5;}} • PHPͷ஋Λ෮ݩՄೳͳจࣈྻʹม׵͢Δɻ • ΫϥεͷΠϯελϯεͰ͋ͬͯ΋ม׵Մೳʂ • DBʹ΋อଘͰ͖Δʂ΍ͬͨͶʂ
  4. αϯϓϧ class POIExample{ private $filename; public function __destruct() { unlink($this->filename);

    } } unserialize('O:10:"POIExample":1:{s: 20:"POIExamplefilename";s:8:"test.php";}')
  5. αϯϓϧ class POIExample{ private $filename; public function __destruct() { unlink($this->filename);

    } } unserialize('O:10:"POIExample":1:{s: 20:"POIExamplefilename";s:8:"test.php";}') ߈ܸऀ͕೚ҙͷϑΝΠϧͷ࡟আ͕Մೳʂ
  6. allowed_classes Φϓγϣϯ $serialized_str = 'O:10:"POIExample":1:{s:20:"POIExamplefilename";s: 8:"test.php";}'; $result = unserialize($serialized_str, ['allowed_classes'

    => false]); var_dump($result); /* object(__PHP_Incomplete_Class)#2 (2) { ["__PHP_Incomplete_Class_Name"]=> string(10) "POIExample" ["filename":"POIExample":private]=> string(8) "test.php" } */ echo serialize($result); // O:10:"POIExample":1:{s:20:"POIExamplefilename";s:8:"test.php";}
  7. ·ͱΊ • serialize(), unserialize()Λ࢖͍ͬͯͳ͍ͷͳΒɺͦΕ͕Ұ൪ • ΋͠࢖͍ͬͯΔͷͳΒɺPOIΛ๷͙ͨΊɺϢʔβʔೖྗσʔλ͕ೖͬͯ͜ͳ͍͜ͳ͍͜ͱΛ͔֬Ί Α͏ • ՄೳͰ͋Ε͹json_encode, json_decodeʹஔ͖͔͑Α͏

    • ͦΕ΋ແཧͳΒɺallowed_classesΦϓγϣϯͰPOI͸͠ͷ͝͏ • DBʹ͸อଘ͠ͳ͍Α͏ʹ͠·͠ΐ͏ • ϝϞϦपΓͷෆ۩߹΋͋ΔͷͰஔ͖׵͑Λݕ౼͠·͠ΐ͏ɻ