fix: Remote Code Execution via Insecure Deserialization in OAuth2

Pek5892 · Pek5892 · commit d2e38cbdf91a · 2026-03-05T10:08:50.000+01:00
diff --git a/src/Models/OAuth2.php b/src/Models/OAuth2.php
@@ -148,7 +148,7 @@ public function getAccessToken()
     {
         $this->checkTokens();
 
-        return $this->attributes['access_token'] ? unserialize($this->attributes['access_token']) : null;
+        return $this->attributes['access_token'] ? unserialize($this->attributes['access_token'], ['allowed_classes' => [AccessToken::class]]) : null;
     }
 
     /**
@@ -190,7 +190,7 @@ protected function updateTokens($access_token, $refresh_token)
      */
     protected function checkTokens()
     {
-        $access_token = $this->access_token ? unserialize($this->access_token) : null;
+        $access_token = $this->access_token ? unserialize($this->access_token, ['allowed_classes' => [AccessToken::class]]) : null;
 
         if (!empty($access_token) && $access_token->hasExpired()) {
             // Tentativo di refresh del token di accesso

Original file line number	Diff line number	Diff line change
`@@ -148,7 +148,7 @@ public function getAccessToken()`
`148`	`148`	`{`
`149`	`149`	`$this->checkTokens();`
`150`	`150`
`151`		`- return $this->attributes['access_token'] ? unserialize($this->attributes['access_token']) : null;`
	`151`	`+ return $this->attributes['access_token'] ? unserialize($this->attributes['access_token'], ['allowed_classes' => [AccessToken::class]]) : null;`
`152`	`152`	`}`
`153`	`153`
`154`	`154`	`/**`
`@@ -190,7 +190,7 @@ protected function updateTokens($access_token, $refresh_token)`
`190`	`190`	`*/`
`191`	`191`	`protected function checkTokens()`
`192`	`192`	`{`
`193`		`- $access_token = $this->access_token ? unserialize($this->access_token) : null;`
	`193`	`+ $access_token = $this->access_token ? unserialize($this->access_token, ['allowed_classes' => [AccessToken::class]]) : null;`
`194`	`194`
`195`	`195`	`if (!empty($access_token) && $access_token->hasExpired()) {`
`196`	`196`	`// Tentativo di refresh del token di accesso`