Dont allow unserializing classes with a destructor - 4.4

symfony · Jan 12, 2021 · b8ad6ca · b8ad6ca
1 parent 7a4176a
commit b8ad6ca
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/Part/DataPart.php b/Part/DataPart.php
@@ -155,7 +155,13 @@ public function __wakeup()
         $r->setValue($this, $this->_headers);
         unset($this->_headers);
 
+        if (!\is_array($this->_parent)) {
+            throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
+        }
         foreach (['body', 'charset', 'subtype', 'disposition', 'name', 'encoding'] as $name) {
+            if (null !== $this->_parent[$name] && !\is_string($this->_parent[$name])) {
+                throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
+            }
             $r = new \ReflectionProperty(TextPart::class, $name);
             $r->setAccessible(true);
             $r->setValue($this, $this->_parent[$name]);