#4954 Security enhancements

inc/utils.inc.php

@@ -2721,34 +2721,6 @@ function bx_api_get_browse_params($sParams, $bParamsOnly = false)
     return $aParams['params'];
 }
 
-function bx_is_serialized_safe($str) 
-{
-    if (!is_string($str))
-        return false;
-    
-    $str = trim($str);
-    if ($str === 'N;')
-        return true; // null
-    
-    if (!preg_match('/^([adObis]):[0-9]+:/', $str, $matches))
-        return false;
-    
-    $type = $matches[1];
-    
-    // allow only base types, exclude objects (O) are references (r, R)
-    $allowedTypes = ['a', 's', 'i', 'd', 'b'];
-    if (!in_array($type, $allowedTypes))
-        return false;
-    
-    try {
-        $unserialized = unserialize($str);
-        return true;
-    } catch (Exception $e) {
-        return false;
-    }
-}
-
-
 function bx_is_serialized($string) 
 {
     if (!is_string($string))

tests/units/inc/UtilTest.php

@@ -124,4 +124,24 @@ class UtilTest extends \PHPUnit\Framework\TestCase
             array('[backslash]test[backslash]', '\\test\\'),
         );
     }
+
+
+    /**
+     * @see bx_is_serialized
+     * @dataProvider providerForBxIsSerialized
+     */
+    function testBxIsSerialized($sIn, $sOut)
+    {
+        $this->assertEquals(bx_is_serialized($sIn), $sOut);
+    }
+    public function providerForBxIsSerialized()
+    {
+        return array(
+            array([], false),
+            array('serialized string', false),
+            array('N;', true),
+            array(serialize([]), true),
+            array(serialize([new stdClass()]), true),
+        );
+    }
 }