Problem/Motivation
LayoutSectionItem currently stores the section as a serialized PHP object. This depends on SqlContentEntityStorage not specifying a restriction on classes to instantiate in \unserialize().
This is not a security issue at the moment because this property does not directly contain user-generated data, but we are trying to avoid these kinds of calls in #3046696: Move from serialized columns to JSON encoded data wherever possible, or use allowed_classes. In addition, this is tightly coupled to #2942975: [PP-1] Expose Layout Builder data to REST and JSON:API, which does introduce some security concerns around data input over the API.
The section property should store the required serialized data to re-create the section object in a simple PHP array or a JSON object, instead. See #2232427: Allow field types to control how properties are mapped to and from storage.
This change was made, with a BC layer, in #2232427: Allow field types to control how properties are mapped to and from storage which provides the new storage mapping API. This issue is for implementing a migration of PHP object sections stored at rest, which have not been updated in the course of using the site with the BC layer.
Steps to reproduce
Proposed resolution
Use JSON or PHP array storage of the serialized section properties, instead.
Comments
Comment #2
bradjones1Comment #3
bradjones1Comment #4
bradjones1