Added fix for unsafe unserialization reported by @mcdruid

Author: tom-fleming

docroot/modules/custom/mass_entityreference/src/Plugin/EntityReferenceSelection/MassFilterEntitiesSelection.php

@@ -28,7 +28,7 @@ protected function buildEntityQuery($match = NULL, $match_operator = 'CONTAINS')
     // Get the users selected filter.
     $cookie = \Drupal::requestStack()->getCurrentRequest()->cookies->get('Drupal_visitor_autocomplete_select_filter');
     if (!empty($cookie)) {
-      $types = unserialize($cookie);
+      $types = json_decode($cookie);
     }
 
     $query = $this->entityTypeManager->getStorage($target_type)->getQuery()->accessCheck();

docroot/modules/custom/mass_entityreference/src/Plugin/Field/FieldWidget/EntityReferenceSelectAutocompleteWidget.php

@@ -59,7 +59,7 @@ public function form(FieldItemListInterface $items, array &$form, FormStateInter
    */
   public static function setFilterSelect(array $form, FormStateInterface $form_state) {
     $select = $form_state->getTriggeringElement();
-    user_cookie_save(['autocomplete_select_filter' => serialize($select['#value'])]);
+    user_cookie_save(['autocomplete_select_filter' => json_encode($select['#value'])]);
     return new AjaxResponse();
   }