security: add allowed_classes => false to SequenceGenerator::unserialize()

[XananasX7]

Summary

The deprecated Serializable::unserialize() method in SequenceGenerator calls unserialize($serialized) without an allowed_classes restriction.

// src/Id/SequenceGenerator.php  (before)
$this->__unserialize(unserialize($serialized));

The serialized payload is always the output of __serialize(), which returns only two scalar values:

['allocationSize' => $this->allocationSize, 'sequenceName' => $this->sequenceName]

No object classes are expected. Without allowed_classes => false, a crafted serialized string supplied to the deprecated method could instantiate arbitrary autoloaded classes during deserialization (PHP Object Injection), potentially triggering a gadget chain.

Fix

$this->__unserialize(unserialize($serialized, ['allowed_classes' => false]));

This is safe because __unserialize() only reads $data['sequenceName'] (string) and $data['allocationSize'] (int).

Notes

• The Serializable interface and its methods are already deprecated; this is a defense-in-depth fix to harden the remaining code path until it is removed in ORM 4.
• No behaviour change for legitimate data.
• The modern __serialize() / __unserialize() magic methods are not affected.

[beberlei]

Its virtually impossible that this happens in real applications as it would require user supplied entity mappings, but we can merge this regardless to avoid machines that are not able to make this conclusion from reporting this again.

[greg0ire]

I'm working on a fix for the static analysis issue: #12493

[XananasX7]

Thanks @beberlei and @greg0ire! I saw PR #12493 — looks like you already have a more complete fix in the works that also addresses the static analysis warning properly. Happy to close this one in favour of that if it covers the same ground. Let me know!

[greg0ire]

It does not cover the same ground at all, it fixes the build. However I think we can close this, so as not to encourage PR that fix issues that do not really exist. I'm confident tooling will get better, and if it doesn't, this looks like something that should be enforced at the linter or static analysis level.