<?php<\/span>\n$test<\/span> =<\/span> new<\/span> User<\/span>();<\/span>\n$test<\/span>-><\/span>name<\/span> =<\/span> \"Denzyl\"<\/span>;<\/span>\necho<\/span> serialize<\/span>(<\/span>$test<\/span>);<\/span>\n\/\/\/ Output: O:4:\"User\":1:{s:4:\"name\";s:6:\"Denzyl\";}<\/span>\n<\/code><\/pre>\n\n<\/div>\n\n\n\nSo, let's digest the string. The o<\/code> stands for Object, and the following number is the length of the object's name. The two letters s<\/code> stand for string and the length of the string's name.
\nWhen you need to convert the string back into PHP, call the unserialize<\/code> function and pass the string as a parameter.<\/p>\n\nWhen serializing an object, two methods are automagically being called. __serialize()<\/code> & __sleep()<\/code>. This will allow the class author to do something before converting the object into a string.
\nThat is straight to the point. But for now, let\u2019s focus on unserializing the string. This means converting the string into a real PHP object that can be later used at runtime in your PHP code.
\n<\/p>\n\n\n<?php<\/span>\n\n$string<\/span> =<\/span> 'O:8:\"User\":1:{s:4:\"name\";s:6:\"Denzyl\";}'<\/span>;<\/span>\necho<\/span> unserialize<\/span>(<\/span>$string<\/span>)<\/span>-><\/span>name<\/span>;<\/span>\n\/\/\/ Output: Denzyl<\/span>\n<\/code><\/pre>\n\n<\/div>\n\n\n\nThe same functionalities also apply to unserializing. But this time, the two methods are __unserialize()<\/code> and __wakeup().<\/code><\/p>\n\n\n \n \n But why is it a bad idea?\n<\/h3>\n\n
Using unserialize<\/code> without knowing it can lead to remote code execution. That's why they say never to trust input.
\nLet's say you are lazy and you trust a random input, and you concatenate to the serialized object so you can
\nchange a value inside the object. BOOM, you can be hacked.
\n<\/p>\n\n\n<?php<\/span>\n$username<\/span> =<\/span> $_GET<\/span>[<\/span>'username'<\/span>];<\/span>\n$serialized<\/span> =<\/span> 'O:8:\"User\":1:{s:4:\"name\";s:6:\"'<\/span> .<\/span> $username<\/span> .<\/span> '\";}'<\/span>;<\/span>\n<\/code><\/pre>\n\n<\/div>\n\n\n\nI won't explain how to write an exploit for something like this. Some tools can automatically generate a payload for you, and you can call yourself a script kiddie(we all start somewhere). The one I know is PHPGGC<\/a>.<\/p>\n\nTo understand the exploit, you can read the OWASP article<\/a>.
\nIf you didn't know this before, also read the rest of the OWASP articles<\/a> about vulnerabilities<\/p>\n\nI know I haven't explained how to write an exploit. I don't think I can do a better job than the articles on the internet. But now you know this, and you can do your research.<\/em><\/p>\n\n\n \n \n How to prevent being exploited?\n<\/h3>\n\n
Why would you want to use this? I do not know; I haven't been programming long enough(~15 years) to have the opportunity to solve a problem using serialize\/unserialize.
\nMy solution is too drastic. The simple answer is. Don't<\/strong> use it in my PHP projects. <\/p>\n\nThis article is part of a series of articles in my journey of writing a static analysis<\/a> tool for PHP that can scan massive projects in a couple of minutes\/seconds. And look for rules
\nthat the developers want to have in their projects. At the time of writing this article, I'm working on a rule to stop
\npeople from using unserialize<\/code>, and it should be ready for the next release. Follow the project<\/a> so that you will get notified when
\nI decided to write even more rules. <\/p>\n\n","category":["php","laravel","webdev","beginners"]},{"title":"Improve your CI output.","pubDate":"Sat, 18 May 2024 20:10:54 +0000","link":"https:\/\/dev.to\/denzyldick\/improve-your-ci-output-2eg","guid":"https:\/\/dev.to\/denzyldick\/improve-your-ci-output-2eg","description":"Have you ever been in a situation where you made a PR or MR and waited for a couple of seconds for the output of the CI pipeline? But something went wrong, and you can't see the issue in the blink of an eye. And you get annoyed that you must read a few logs to discover the problem? <\/p>\n\n
It's a scenario that many of us have likely encountered at some point.<\/p>\n\n
This article teaches how to improve your CI output. I will use Github.<\/p>\n\n
\nThis article is part of a series about a static analysis tool I've worked on for over a year. It's called Phanalist<\/a>. Please check it out and hit the star button. Thank you.<\/p>\n<\/blockquote>\n\nHow can I improve the CI output in Github? When running your CI tools, you probably output everything to STDOUT and view the content in the log viewer.<\/p>\n\n
Something like this:<\/p>\n\n
![\"Image](\"https:\/\/media.dev.to\/cdn-cgi\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto\/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F6jkmm3hl8flza7socosu.png\")
<\/a><\/p>\n\nThe output format text in Phanalist is not so bad. It's readable because of the table layout. But why stop there? <\/p>\n\n
Microsoft is not so evil anymore, and Github has solved that problem I've already. What we will be using is what they call SARIF<\/code>. It stands
\nfor Static Analysis Results Interchange Format. It's a specification for understanding the output of static analysis tools. That is how the tools can display information in the code scanning section under the security tab on a repository. <\/p>\n\n![\"Image](\"https:\/\/media.dev.to\/cdn-cgi\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto\/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fzibtgelhhm0kyx8x1yys.png\")
<\/a><\/p>\n\nFor Phanalist to have a chance to be adopted by more people, this is a must feature that should be implemented first. Then, I can focus on adding more rules to the tool. <\/p>\n\n