Nexus API Reference

PhpNativeSerializer
in package
implements MessageSerializer

Read onlyYes
FinalYes
Tags
psalm-api

Serializer using PHP's native serialize()/unserialize().

SECURITY: unserialize() can instantiate arbitrary classes and trigger their __wakeup()/__destruct() gadgets (PHP Object Injection, CWE-502). This serializer therefore REQUIRES an explicit allow-list of permitted classes: anything outside the list — at any depth of the object graph — is refused instead of instantiated, and graphs containing refused nested objects are rejected as a whole.

new PhpNativeSerializer(allowedClasses: $registry->allClasses());

The allow-list must include every nested class in the graph (value objects, enums, DateTimeImmutable, ...), not just the top-level type.

Deserializing arbitrary graphs without a list is an explicit opt-in for data the application serialized itself and that never crossed a trust boundary: PhpNativeSerializer::forTrustedData(). For untrusted input prefer a schema-based codec such as ValinorMessageSerializer.

Table of Contents

Interfaces

MessageSerializer

Methods

__construct()  : mixed
deserialize()  : object
Deserializes a string representation back into a message object.
forTrustedData()  : self
Allow-any deserialization for data that never crossed a trust boundary.
serialize()  : string
Serializes a message object to a string representation.

Methods

__construct()

public __construct(array<int, class-string>|null $allowedClasses) : mixed
Parameters
$allowedClasses : array<int, class-string>|null

Classes permitted to be instantiated during deserialization, at any depth of the graph. Pass the explicit allow-list; use forTrustedData() instead of null for the allow-any trusted-data opt-in.

deserialize()

Deserializes a string representation back into a message object.

public deserialize(string $data, string $type) : object
Parameters
$data : string
$type : string
Tags
throws
MessageDeserializationException
Attributes
#[NoDiscard]
#[Override]
Return values
object

forTrustedData()

Allow-any deserialization for data that never crossed a trust boundary.

public static forTrustedData() : self

Explicit opt-in: only use when the application itself produced the serialized bytes and stores them where no attacker or operator can influence rows (CWE-502 — gadget chains become RCE otherwise).

Return values
self

serialize()

Serializes a message object to a string representation.

public serialize(object $message) : string
Parameters
$message : object
Tags
throws
MessageSerializationException
Attributes
#[NoDiscard]
#[Override]
Return values
string
On this page

Search results