FILE: D:\xampp\htdocs\drupal_10\web\modules\contrib\content_access\content_access.module
--------------------------------------------------------------------------------------------------------------------------------------------
FOUND 2 ERRORS AFFECTING 2 LINES
--------------------------------------------------------------------------------------------------------------------------------------------
254 | ERROR | unserialize() is insecure unless allowed classes are limited. Use a safe format like JSON or use the allowed_classes option.
538 | ERROR | unserialize() is insecure unless allowed classes are limited. Use a safe format like JSON or use the allowed_classes option.
--------------------------------------------------------------------------------------------------------------------------------------------

FILE: D:\xampp\htdocs\drupal_10\web\modules\contrib\content_access\src\Form\ContentAccessPageForm.php
--------------------------------------------------------------------------------------------------------------------------------------------
FOUND 1 ERROR AFFECTING 1 LINE
--------------------------------------------------------------------------------------------------------------------------------------------
127 | ERROR | unserialize() is insecure unless allowed classes are limited. Use a safe format like JSON or use the allowed_classes option.
--------------------------------------------------------------------------------------------------------------------------------------------

Comments

arti_parmar created an issue. See original summary.

arti_parmar’s picture

Assigned: arti_parmar » Unassigned
Category: Task » Bug report
Issue summary: View changes
Status: Active » Needs review
StatusFileSize
new1.67 KB

Kindly review patch.

gisle’s picture

Status: Needs review » Postponed (maintainer needs more info)

Most of this patch is outdated because of this update: #3383677: Getting error page after the latest ACL module security update..

If this get committed: #3377809: Config is stored with serialized data, all of it will become outdated.

We now use JSON. Is it still necessary to use the allowed_classes option?

steven jones’s picture

Status: Postponed (maintainer needs more info) » Needs work

@gisle we still use serialize/unserialize in a few places, right?

Essentially, if we're only ever intending to store scalar values and arrays in those places, we should indeed pass , ['allowed_classes' => FALSE] as per this patch.

So yeah, I think we need this in 2.0.x.

Setting to needs work, as someone needs to provide an updated patch.

gisle’s picture

Status: Needs work » Needs review
StatusFileSize
new1.17 KB

It is still used two places, in content_access.module. and in an update hook is content_access.install.

Readinng the manual page (PHP.net: unserialize), it looks like the second option should be ['allowed_classes' => FALSE] if we're unserializing an array.

I've rerolled the patch to reflect this. Please review.

steven jones’s picture

Status: Needs review » Fixed

Thanks @arti_parmar and @gisle this looks to have been committed here: https://git.drupalcode.org/project/content_access/-/commit/f052779116bc9...
albeit with the wrong commit message, no worries.

This made it into 2.0.0 too!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.