FILE: D:\xampp\htdocs\drupal_10\web\modules\contrib\content_access\content_access.module
--------------------------------------------------------------------------------------------------------------------------------------------
FOUND 2 ERRORS AFFECTING 2 LINES
--------------------------------------------------------------------------------------------------------------------------------------------
254 | ERROR | unserialize() is insecure unless allowed classes are limited. Use a safe format like JSON or use the allowed_classes option.
538 | ERROR | unserialize() is insecure unless allowed classes are limited. Use a safe format like JSON or use the allowed_classes option.
--------------------------------------------------------------------------------------------------------------------------------------------
FILE: D:\xampp\htdocs\drupal_10\web\modules\contrib\content_access\src\Form\ContentAccessPageForm.php
--------------------------------------------------------------------------------------------------------------------------------------------
FOUND 1 ERROR AFFECTING 1 LINE
--------------------------------------------------------------------------------------------------------------------------------------------
127 | ERROR | unserialize() is insecure unless allowed classes are limited. Use a safe format like JSON or use the allowed_classes option.
--------------------------------------------------------------------------------------------------------------------------------------------
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | content_access-3368266-5.patch | 1.17 KB | gisle |
Comments
Comment #2
arti_parmar commentedKindly review patch.
Comment #3
gisleMost of this patch is outdated because of this update: #3383677: Getting error page after the latest ACL module security update..
If this get committed: #3377809: Config is stored with serialized data, all of it will become outdated.
We now use JSON. Is it still necessary to use the
allowed_classesoption?Comment #4
steven jones commented@gisle we still use
serialize/unserializein a few places, right?Essentially, if we're only ever intending to store scalar values and arrays in those places, we should indeed pass
, ['allowed_classes' => FALSE]as per this patch.So yeah, I think we need this in 2.0.x.
Setting to needs work, as someone needs to provide an updated patch.
Comment #5
gisleIt is still used two places, in
content_access.module. and in an update hook iscontent_access.install.Readinng the manual page (PHP.net: unserialize), it looks like the second option should be
['allowed_classes' => FALSE]if we're unserializing an array.I've rerolled the patch to reflect this. Please review.
Comment #6
steven jones commentedThanks @arti_parmar and @gisle this looks to have been committed here: https://git.drupalcode.org/project/content_access/-/commit/f052779116bc9...
albeit with the wrong commit message, no worries.
This made it into 2.0.0 too!