Security: change PhpSerializeOptions $allowedClasses default to false

[XananasX7]

Summary

Change the default value of PhpSerializeOptions::$allowedClasses from true to false.

Security Motivation

The current default (true) means that when PhpSerialize::unserialize() is called without explicit allowed_classes configuration, PHP will happily instantiate any class available in the autoloader during deserialization. This is the vector for PHP Object Injection (POI) attacks — an attacker who controls the serialized payload can exploit available gadget chains.

This is especially dangerous in the common usage pattern where:

1. The application stores serialized data in a shared cache backend (Redis, Memcache, file system)
2. An attacker can influence the cache contents (e.g. cache key injection, SSRF to cache, compromised backend)
3. The application deserializes without an explicit allowed_classes allowlist

Change

-protected bool|array $allowedClasses = true;
+protected bool|array $allowedClasses = false;

Migration

Applications that legitimately deserialize objects must now opt in explicitly:

// Allow all classes (restore legacy behaviour):
$options->setAllowedClasses(true);

// Allow specific classes only (recommended):
$options->setAllowedClasses([MyModel::class, AnotherClass::class]);

Impact

This is a breaking change for callers that:

1. Use PhpSerialize without configuring allowed_classes, AND
2. Expect objects to be deserialized (not just scalars/arrays)

The fix is to add an explicit allowlist at the call site.

Related

• PHP docs: https://www.php.net/unserialize
• OWASP PHP Object Injection: https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection

[arueckauer]

@XananasX7 Thanks for your contribution! After discussing this with the maintainer, we'd like to target this for the 4.0 release. Could you please change the base branch to target 4.x? Also, please take a look at the failing CI builds and update the PR to get the tests green. Let us know if you need any assistance with this!