Interview question
What is insecure deserialization and how do you avoid it in PHP? Insecure deserialization क्या है और PHP में इससे कैसे बचें?
Answer
PHP's unserialize() can instantiate objects and trigger magic methods (__wakeup, __destruct) from attacker-controlled data, potentially leading to remote code execution.
Vulnerable:
An attacker can craft a serialized payload that triggers unintended object behavior when instantiated.
Safer:
$data = unserialize($_COOKIE['user_data']);An attacker can craft a serialized payload that triggers unintended object behavior when instantiated.
Safer:
$data = json_decode($_COOKIE['user_data'], true);| Practice | Why |
|---|---|
| Use JSON instead of PHP serialization for untrusted data | JSON has no code-execution side effects |
| If unserialize() is required, use allowed_classes option | Limits which classes can be instantiated |
$data = unserialize($input, ['allowed_classes' => false]);PHP का unserialize() attacker-controlled data से objects बना सकता है और magic methods trigger कर सकता है, जिससे remote code execution हो सकता है।
असुरक्षित:
सुरक्षित:
$data = unserialize($_COOKIE['user_data']);सुरक्षित:
$data = json_decode($_COOKIE['user_data'], true);Was this answer clear?