Added the ability to sign and verify closure serializations.

[jeremeamia]

No description provided.

[GrahamCampbell]

Incorrect order of annotations here.

[jeremeamia]

I'm unaware of any ordering rules. Link?

[GrahamCampbell]

This is something' that's implied by PSR-5 in their code examples. I'm also developing docblock fixers for php-cs-fixer that enforce the order param, throws, return for the annotations.

PHP-CS-Fixer/PHP-CS-Fixer#887

[GrahamCampbell]

NB, I did actually run regression testing on the aws sdk at one point. :)

[GrahamCampbell]

I suspect a lot of people will use the serializer class to serialize, but end up using php's unserialize function later in their code, kind of voiding this. Laravel does this currently (or rather, the equivalent in the 1.x version).

[jeremeamia]

I attempted a solution that would work that way, but was met with segfault after segfault.

[GrahamCampbell]

:(

[GrahamCampbell]

I don't think adding this into 2.0 is a good idea. I think we should probably wait for feedback on it and put it into 2.1.

[ircmaxell]

Just for form, can the unrelated readme changes be removed from the PR?

[ircmaxell]

The signature should be appended or prepended to the result. It shouldn't be "re-serailized" into a new one. That's because unserializing user input can be disruptive. See http://blog.codeclimate.com/blog/2013/01/10/rails-remote-code-execution-vulnerability-explained/

Instead, consider prepending the signature, either base64 encoded or hex encoded. That way you can just substr it off .

So unserializing user input is a no-no. Instead, something like this should be done:

if ($this->signingKey) {
    if ($signature[0] !== '%') {
        throw new \ClosureUnserializationException('Attempting to verify unsigned serialization with a key');
    }
    $signature = substr($serialized, 1, 88);
    $data = substr($serialized, 89);
    if (!hash_equals(base64_decode($signature) , hash_hmac('sha256', $data, $this->signingKey))) {
        throw new ...
    }
    $unserialized = unserialize($data);
} elseif ($signature[0] == '%') {
    throw new \ClosureUnserializationException('Attempting to unserialize signed serialization without a key');
}

The % check is just a quick way to force verification, and since it's invalid as a first character in a serialization, it shouldn't be a problem...

[jeremeamia]

Cool, that makes sense.

[Ocramius]

Very nice feature. You should also factor the lib version in the hash tho.

[jeremeamia]

@ircmaxell I updated the pull request incorporating your recommendations. Please take another look and make sure I'm on track. Thanks.

[ircmaxell]

You may want to check for % here if signing key is not set (and hence strip off the token). As if you don't verify a signed serialization will not be unserializable otherwise.