[Security] Harden Serialize::unserialize() callers and deprecate the permissive default (pimcore#19293)

* [Security] Make Serialize::unserialize() safe by default

Serialize::unserialize() defaulted its allowedClasses argument to true, so every
single-argument caller permitted arbitrary PHP object deserialization. Flip the default
to false (no object instantiation) and pass an explicit argument at every existing caller:

- callers that only handle scalars/arrays now pass false;
- callers that reconstruct known stored value objects pass a scoped allowlist
  (e.g. Geopolygon/Geopolyline -> GeoCoordinates);
- callers that reconstruct open, user-defined object graphs (element versions, recycle
  bin, session elements, encrypted fields, and object field data) pass an explicit true,
  to be scoped further as a follow-up.

Also restrict two raw unserialize() calls (a CoreBundle migration and the SeoBundle
controller) to allowed_classes => false.

Adds tests/Unit/Tool/SerializeTest.php covering the safe default, explicit allowlist,
explicit true, and scalar/array round-trips.

Co-Authored-By: Claude <noreply@anthropic.com>

* Keep Serialize::unserialize() default as-is and deprecate omitting the argument

Reverts the default flip (true -> false) to preserve backward compatibility: the
wrapper is public, non-@internal API, so changing its default behaviour on a minor
line would silently break external callers that rely on it to reconstruct objects.

Instead, keep the default `true` and emit a deprecation when the $allowedClasses
argument is omitted, so callers migrate to an explicit value. The default will be
switched to `false` in Pimcore 2027.1. The per-caller hardening (explicit arguments
at every core call site) and the raw-unserialize() fixes are unchanged and remain the
actual security improvement.

Co-Authored-By: Claude <noreply@anthropic.com>

* Add upgrade note for the Serialize::unserialize() deprecation

Documents the deprecation of the permissive default under the next 12.3 patch, matching
the repository's upgrade-notes convention (deprecation + the 2027.1 removal target).

Co-Authored-By: Claude <noreply@anthropic.com>

* Emit the unserialize() deprecation once per process + cover geo datatypes in blocks

Addresses review feedback:

- Serialize::unserialize() emitted the "$allowedClasses omitted" deprecation on every call,
  which could flood the logs when unserializing in a loop (e.g. a listing of many objects).
  Guard it with a static flag so it fires at most once per process. The unit test now asserts
  a second omitting call stays silent.

- Add geo child fields (geopoint, geobounds, geopolygon, geopolyline) to the test block and a
  BlockTest case that round-trips all four inside a block, proving Block::getDataFromResource()'s
  `Serialize::unserialize($data, false)` does not neutralise geo values (they are stored
  normalized and rebuilt via each sub-field's denormalize()).

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mcop1

bundles/CoreBundle/src/Migrations/Version20230424084415.php

@@ -33,7 +33,7 @@ public function up(Schema $schema): void
             $editables = $db->fetchAllAssociative('SELECT * FROM documents_editables WHERE type = ?', ['link']);
 
             foreach ($editables as $editable) {
-                $unserialized = unserialize($editable['data']);
+                $unserialized = unserialize($editable['data'], ['allowed_classes' => false]);
                 if (is_array($unserialized) && array_key_exists('attributes', $unserialized)) {
                     unset($unserialized['attributes']);
 

bundles/SeoBundle/src/Controller/MiscController.php

@@ -87,7 +87,7 @@ public function httpErrorLogDetailAction(Request $request, ?Profiler $profiler):
 
         foreach ($data as $key => &$value) {
             if ($key === 'parametersGet') {
-                $value = unserialize($value);
+                $value = unserialize($value, ['allowed_classes' => false]);
             }
         }
 

doc/23_Installation_and_Upgrade/09_Upgrade_Notes/README.md

@@ -1,5 +1,16 @@
 # Upgrade Notes
 
+## Pimcore 12.3.12
+
+### Deprecations
+
+#### [Serialization]
+
+Calling `Pimcore\Tool\Serialize::unserialize()` without the `$allowedClasses` argument is deprecated.
+Pass an explicit value: `false` to forbid object deserialization (the safe choice for scalar/array data),
+or an array of allowed class names when a trusted stored object graph must be reconstructed.
+The default changes from `true` to `false` (object deserialization disabled) in Pimcore 2027.1.
+
 ## Pimcore 12.3.10
 
 ### Deprecations

lib/DataObject/ClassificationstoreDataMarshaller/QuantityValueRange.php

@@ -41,7 +41,7 @@ public function marshal(mixed $value, array $params = []): mixed
     public function unmarshal(mixed $value, array $params = []): mixed
     {
         if (is_array($value) && ($value['value'] !== null || $value['value2'] !== null)) {
-            $minMaxValue = Serialize::unserialize($value['value'] ?? null);
+            $minMaxValue = Serialize::unserialize($value['value'] ?? null, false);
 
             return [
                 'minimum' => $minMaxValue['minimum'] ?? null,

lib/DataObject/ClassificationstoreDataMarshaller/Table.php

@@ -33,7 +33,7 @@ public function marshal(mixed $value, array $params = []): mixed
     public function unmarshal(mixed $value, array $params = []): mixed
     {
         if (is_array($value)) {
-            return Serialize::unserialize($value['value']);
+            return Serialize::unserialize($value['value'], false);
         }
 
         return null;

lib/Tool/Serialize.php

@@ -21,17 +21,47 @@ final class Serialize
 {
     protected static array $loopFilterProcessedObjects = [];
 
+    /**
+     * Ensures the "missing $allowedClasses argument" deprecation is emitted at most once per
+     * process, so callers that unserialize in a loop (e.g. a listing of many objects) cannot
+     * flood the logs with the identical notice.
+     */
+    private static bool $unserializeWithoutAllowedClassesDeprecationTriggered = false;
+
     public static function serialize(mixed $data): string
     {
         return serialize($data);
     }
 
+    /**
+     * Pass an array of class names to allow only those classes during deserialization, `false` to
+     * forbid object deserialization entirely (the safe choice for scalar/array data), or `true` to
+     * allow any class when reconstructing a trusted, non-attacker-writable stored object graph.
+     *
+     * Omitting the argument is deprecated: it currently defaults to the permissive `true` for
+     * backward compatibility, but the default will change to `false` in Pimcore 2027.1. Every caller
+     * should pass an explicit value before then.
+     *
+     * @param array<int, class-string>|bool $allowedClasses
+     */
     public static function unserialize(?string $data = null, array|bool $allowedClasses = true): mixed
     {
         if ($data === null || $data === '') {
             return $data;
         }
 
+        if (func_num_args() < 2 && !self::$unserializeWithoutAllowedClassesDeprecationTriggered) {
+            self::$unserializeWithoutAllowedClassesDeprecationTriggered = true;
+            trigger_deprecation(
+                'pimcore/pimcore',
+                '12.3',
+                'Calling %s() without the $allowedClasses argument is deprecated. Pass an explicit '
+                . 'value: the default will change from true to false (object deserialization disabled) '
+                . 'in Pimcore 2027.1.',
+                __METHOD__
+            );
+        }
+
         return unserialize($data, [
             'allowed_classes' => $allowedClasses,
         ]);

models/DataObject/ClassDefinition/Data/Block.php

@@ -170,7 +170,7 @@ public function getDataFromResource(mixed $data, ?DataObject\Concrete $object =
                 }, $data);
             }
 
-            $unserializedData = Serialize::unserialize($data);
+            $unserializedData = Serialize::unserialize($data, false);
             $result = [];
 
             foreach ($unserializedData as $blockElements) {

models/DataObject/ClassDefinition/Data/ImageGallery.php

@@ -139,7 +139,7 @@ public function getDataFromResource(mixed $data, ?DataObject\Concrete $object =
 
         $images = $data[$this->getName() . '__images'];
         $hotspots = $data[$this->getName() . '__hotspots'];
-        $hotspots = $hotspots ? Serialize::unserialize($hotspots) : [];
+        $hotspots = $hotspots ? Serialize::unserialize($hotspots, true) : [];
 
         if (!$images) {
             return $this->createEmptyImageGallery($params);

models/DataObject/ClassDefinition/Data/Video.php

@@ -135,7 +135,7 @@ public function getDataForResource(mixed $data, ?DataObject\Concrete $object = n
     public function getDataFromResource(mixed $data, ?Concrete $object = null, array $params = []): ?DataObject\Data\Video
     {
         if ($data) {
-            $raw = Serialize::unserialize($data);
+            $raw = Serialize::unserialize($data, false);
 
             if ($raw['type'] === 'asset') {
                 if ($asset = Asset::getById($raw['data'])) {

models/DataObject/Data/EncryptedField.php

@@ -105,7 +105,7 @@ public function __wakeup(): void
 
                 $data = Crypto::decrypt($this->encrypted, $key, true);
 
-                $data = Serialize::unserialize($data);
+                $data = Serialize::unserialize($data, true);
 
                 if ($data instanceof OwnerAwareFieldInterface) {
                     $data->_setOwner($this->_owner);