Skip to content

fix: harden unserialize() against PHP object injection #1339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Soare-Robert-Daniel merged 12 commits into from
Jul 15, 2026
Merged

fix: harden unserialize() against PHP object injection #1339

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
c01f0ec
fix: harden unserialize() against PHP object injection
Jul 14, 2026
a9a333b
test: add object-injection regression test for unserialize() guard
Jul 14, 2026
3570a8b
test: satisfy PHPCS doc-comment rules on object-injection test
Jul 14, 2026
53b332d
refactor: route all unserialize sinks through one guarded helper + test
Jul 15, 2026
71f043f
fix: guard maybe_unserialize() render sink + PHPStan/test coverage
Jul 15, 2026
72d2038
test: cover Gutenberg block render call site for object injection
Jul 15, 2026
8e7c9cb
Merge branch 'development' into fix/unserialize-object-injection
Soare-Robert-Daniel Jul 15, 2026
b582547
fix: read requested chart's raw post_content in block render
Soare-Robert-Daniel Jul 15, 2026
e1af417
fix: decode wizard sample data through the safe unserialize chokepoint
Soare-Robert-Daniel Jul 15, 2026
e560125
fix: guard chart-clone meta copy against object injection
Soare-Robert-Daniel Jul 15, 2026
fcd92ac
fix: guard revision meta copy against object injection
Soare-Robert-Daniel Jul 15, 2026
2d1bb5a
fix: strip incomplete-class stubs from decoded chart content
Soare-Robert-Daniel Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion classes/Visualizer/Gutenberg/Block.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -307,7 +307,7 @@ public function get_visualizer_data( $post ) {
$data['visualizer-settings'] = apply_filters( Visualizer_Plugin::FILTER_GET_CHART_SETTINGS, $data['visualizer-settings'], $post_id, $data['visualizer-chart-type'] );

// handle data filter hooks
$data['visualizer-data'] = apply_filters( Visualizer_Plugin::FILTER_GET_CHART_DATA, unserialize( html_entity_decode( get_the_content( $post_id ) ) ), $post_id, $data['visualizer-chart-type'] );
$data['visualizer-data'] = apply_filters( Visualizer_Plugin::FILTER_GET_CHART_DATA, unserialize( html_entity_decode( get_the_content( $post_id ) ), array( 'allowed_classes' => false ) ), $post_id, $data['visualizer-chart-type'] );

Comment on lines 309 to 311
// we are going to format only for tabular charts, because we are not sure of the effect on others.
// this is to solve the case where boolean data shows up as all-ticks on gutenberg.
Expand Down
2 changes: 1 addition & 1 deletion classes/Visualizer/Module.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -793,7 +793,7 @@ function ( $matches ) {
},
$post_content
);
$data = unserialize( $post_content );
$data = unserialize( $post_content, array( 'allowed_classes' => false ) );
$altered = array();
if ( ! empty( $data ) ) {
foreach ( $data as $index => $array ) {
Expand Down
4 changes: 2 additions & 2 deletions classes/Visualizer/Module/Chart.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1336,8 +1336,8 @@ public function uploadData() {
if ( $source->fetch() ) {
$content = $source->getData( get_post_meta( $chart_id, Visualizer_Plugin::CF_EDITABLE_TABLE, true ) );
$populate = true;
if ( is_string( $content ) && is_array( unserialize( $content ) ) ) {
$json = unserialize( $content );
$json = is_string( $content ) ? unserialize( $content, array( 'allowed_classes' => false ) ) : false;
if ( is_array( $json ) ) {
// if source exists, so should data. if source exists but data is blank, do not populate the chart.
// if we populate the data even if it is empty, the chart will show "Table has no columns".
if ( array_key_exists( 'source', $json ) && ! empty( $json['source'] ) && ( ! array_key_exists( 'data', $json ) || empty( $json['data'] ) ) ) {
Expand Down
2 changes: 1 addition & 1 deletion classes/Visualizer/Module/Utility.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -434,7 +434,7 @@ private static function set_defaults_chartjs( $chart, $post_status ) {
case 'polarArea':
// fall through.
case 'pie':
$data = unserialize( $chart->post_content );
$data = unserialize( $chart->post_content, array( 'allowed_classes' => false ) );
$name = 'slices';
$max = count( $data );
// fall through.
Expand Down
2 changes: 1 addition & 1 deletion classes/Visualizer/Source/Csv/Remote.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ private function _repopulate( $chart_id ) {
// if filename is empty, extract it from chart content
if ( empty( $this->_filename ) ) {
$chart = get_post( $chart_id );
$data = unserialize( html_entity_decode( $chart->post_content ) );
$data = unserialize( html_entity_decode( $chart->post_content ), array( 'allowed_classes' => false ) );
if ( ! isset( $data['source'] ) ) {
return false;
}
Expand Down
Loading