PHPackages                             n2n/n2n-util-serialize - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. n2n/n2n-util-serialize

ActiveLibrary[Security](/categories/security)

n2n/n2n-util-serialize
======================

Safely serialize and unserialize plain data objects (PHP native serialize()/unserialize() with an allowed\_classes allowlist derived from the class structure) and scalar/null values (JSON), preventing object-injection and POP-chain attacks.

7.5.x-dev(yesterday)01↑2900%LGPL-3.0-or-later

Since Jul 22Compare

[ Source](https://github.com/n2n/n2n-util-serialize)[ Packagist](https://packagist.org/packages/n2n/n2n-util-serialize)[ Docs](https://n2n.rocks/)[ RSS](/packages/n2n-n2n-util-serialize/feed)WikiDiscussions Synced today

READMEChangelogDependencies (4)Versions (3)Used By (0)

n2n-util-serialize
==================

[](#n2n-util-serialize)

Safe serialization of plain data objects and scalar values for the n2n framework.

PHP's native [`serialize()`](https://www.php.net/manual/en/function.serialize.php) / [`unserialize()`](https://www.php.net/manual/en/function.unserialize.php) on untrusted input is a well-known vector for **object-injection / POP-chain attacks**: a crafted payload can instantiate arbitrary classes and trigger their `__wakeup()`, `__unserialize()`, `__destruct()` (or the `Serializable::unserialize()` callback) with attacker-controlled data.

This library provides `SerializationUtils::strictSerialize()` and `SerializationUtils::strictUnserialize()`, which make round-tripping plain data objects — and scalar values — safe. Each takes a `$typeName` describing the expected type:

- For a **class** type the value uses PHP's native object format, made safe by:
    1. Validating the structure of the root class — and transitively every class reachable through its object-typed properties.
    2. Passing the resulting transitive set of safe class names to `unserialize()` as `allowed_classes`, so objects of any other class degrade to `__PHP_Incomplete_Class` instead of being instantiated.
    3. Letting PHP's typed-property enforcement constrain every property to its declared type.
    4. Verifying the returned object is of the exact expected class.
- For a **scalar** or `null` type (`int`, `float`, `bool`, `string`, `null`) the value is encoded as JSON, which is inherently free of object instantiation.

Installation
------------

[](#installation)

```
composer require n2n/n2n-util-serialize
```

What makes a class serializable
-------------------------------

[](#what-makes-a-class-serializable)

A class is accepted by `SerializableClassAnalyser` only if it is:

- a concrete class (not abstract, not an interface, not a trait) or a PHP 8.1 enum,
- `final` (the root class and every object-typed property type; enums are final by definition),
- free of any method PHP could invoke during (un)serialization: `__sleep`, `__wakeup`, `__serialize`, `__unserialize`, `serialize`, `unserialize`, `__destruct`, `__set`, `__get`,
- and every property is typed as a scalar (`int`, `float`, `bool`, `string`), `null`, an enum, or an object of another accepted class.

Untyped, `mixed`, `array` and intersection property types are rejected. Enums are treated as terminal leaves — their cases are not recursed into. Parent classes are analysed too (they need not be `final`, but must satisfy the other rules).

```