After updating to version 2.7.2 I got following error on my login page.

PHP Fatal error: Uncaught exception 'Zend\\Serializer\\Exception\\RuntimeException' with message 'Serialized data must be a string containing serialized PHP code; received: NULL' in vendor/zendframework/zend-serializer/src/Adapter/PhpSerialize.php:75\nStack trace:\n#0 vendor/zendframework/zend-cache/src/Storage/Plugin/Serializer.php(72): Zend\\Serializer\\Adapter\\PhpSerialize->unserialize(NULL)\n#1 [internal function]: Zend\\Cache\\Storage\\Plugin\\Serializer->onReadItemPost(Object(Zend\\Cache\\Storage\\PostEvent))\n#2 vendor/zendframework/zend-eventmanager/src/EventManager.php(490): call_user_func(Array, Object(Zend\\Cache\\Storage\\PostEvent))\n#3 vendor/zendframework/zend-eventmanager/src/EventManager.php(251): Zend\\EventManager\\EventManager->triggerListeners('getItem.post', Object(Zend\\Cache\\Storage\\PostEvent))\n#4 vendor/zendframework/ in vendor/zendframework/zend-serializer/src/Adapter/PhpSerialize.php on line 75

@Maks3w

Following discussion, is this what we are after? Do not merge, until rest are complete for this component. This is just a sample - please add tag WIP.

What are your thoughts on group tag?

Hi,

This is my second contribution towards ZF2. I hope it suits this module well.

There was a skipped test (commented out) as well as the use of eval(). I did notice a comment with a warning so thought I put my contribution forward. Please review and let me know if it is acceptable.

Awaiting your comments. Unit tests and builds passing.

Also did php-cs-fixes.

Ps. There may be other scenarios I can cover in this branch. But ideally I want to get some feedback before continuing.

The PhpSerialize adapter uses unserialize() (see PhpSerialize.php#L88) to convert a string into a PHP Object (array, string, class-instance. ...).

PHP 7.0 added an option to only allow the deserialization of whitelisted classes via the "options['allowed_classes']" parameter to combat code-injection.

I'm proposing adding an options to PhpSerialize class to uses this whitelist.

Practical application: this could be used in "zend-i18n" (using "zend-cache" and "zend-serializer") for the translation-cache. It should only allow the deserialization of objects that are instance of Zend\I18n\Translator\TextDomain (or plain arrays).

Discovered in Fedora CI, https://apps.fedoraproject.org/koschei/package/php-zendframework-zend-serializer?collection=f25

There was 1 failure:
1) ZendTest\Serializer\Adapter\WddxTest::testUnserializeFalse
Failed asserting that true matches expected false.
/builddir/build/BUILD/zend-serializer-ff74ea020f5f90866eb28365327e9bc765a61a6e/test/Adapter/WddxTest.php:136
FAILURES!

Not detected by travis as wddx extension is not available, and not yet covered by PHP test suite. Can you please enable it ?

This is an upstream bug, see https://bugs.php.net/bug.php?id=72564 Fix will be in 7.0.10

So mostly for your information

• Aliases typically need to be in each of:
  • lowercase
  • camelCase
  • TitleCase
• Factories mapping to the InvokableFactory must be FQCNs only. The normalized version used in v2 (stripping special characters and lowercasing) will likely never be used to retrieve a service, and can be skipped.

Apache/2.4.20 (Win32) PHP/5.6.21 Exception in …\vendor\zendframework\zend-cache\src\Storage\Plugin\PluginOptions.php:215

$cache = StorageFactory::factory([
			'adapter' => [
				'name' => 'filesystem',
				'options'=>[
					'cache_dir'=>'.\filessys\local\tabletka\',
				]
			],
			'plugins' => [
				// Don't throw exceptions on cache errors
				'exception_handler' => [
					'throw_exceptions' => false
				],
				'serializer',
			],
		]);

With version 2 package has been renamed from satooshi/php-coveralls to php-coveralls/php-coveralls, and the script has been renamed from coveralls to php-coveralls

Release 2.8.1 fixes failing tests in PR https://github.com/zendframework/zend-serializer/pull/32 There is added redundant doctrine dependency. In other repositories we handled this situation by updating legacy deps on testing with locked dependencies to make sure we have installed correct dependencies on each PHP version.

This PR provides also changes to the documentation of the library done by zf-maintainer tool (see maintainers repo) and adds support for PHPUnit 6.4.

Travis CI configuration is now updated - dropped HHVM support and added PHP 7.1 & 7.2 builds.

• Use ^ operator when possible
• Updated zend-stdlib to ^2.7 || ^3.0, as the changes in zend-stdlib 3.0 will not affect the functionality in this repository. This allows it to be used as a dev dependency for zend-stdlib v3 as well.

Every adapter should raise an exception if the input for unserialize is not a serialized string.

The bug was introduced on Dec 16, 2011 here https://github.com/zendframework/zf2/commit/64f4d52f40873996a6b21aeee82cdedb047ceb53#diff-4ae37c6308a6960757fa49d2da5f1485R106

... because it's using eval.

It's only useful for testing/debugging but to dangerous to use for wrong purpose. Because of that I propose to remove this adapter as it's also really simple to write it byself in case someone really needs it.

See #5

PS: The serializer can't use PHP's opcache as that would be another possible use as pointed out by @Ocramius - but as told it cant be done by serializer component and would live better in zend-cache.