[RFC] Add #[\NotSerializable] attribute

Zend/tests/attributes/not_serializable/001-base.phpt

@@ -0,0 +1,29 @@
+--TEST--
+#[NotSerializable] basic behavior
+--FILE--
+<?php
+
+#[NotSerializable]
+class Foo {
+    public int $x = 42;
+}
+
+try {
+    $s = serialize(new Foo());
+    echo "Should not reach here\n";
+} catch (Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+
+try {
+    $data = 'O:3:"Foo":1:{s:1:"x";i:42;}';
+    unserialize($data);
+    echo "Should not reach here\n";
+} catch (Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECTF--
+Serialization of 'Foo' is not allowed
+Unserialization of 'Foo' is not allowed

Zend/tests/attributes/not_serializable/002-inheritance.phpt

@@ -0,0 +1,31 @@
+--TEST--
+#[NotSerializable] inheritance behavior
+--FILE--
+<?php
+
+#[NotSerializable]
+class Foo {
+    public int $x = 42;
+}
+
+class Bar extends Foo {}
+
+try {
+    $s = serialize(new Bar());
+    echo "Should not reach here\n";
+} catch (Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+
+try {
+    $data = 'O:3:"Bar":1:{s:1:"x";i:42;}';
+    unserialize($data);
+    echo "Should not reach here\n";
+} catch (Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECTF--
+Serialization of 'Bar' is not allowed
+Unserialization of 'Bar' is not allowed

Zend/tests/attributes/not_serializable/003-interface.phpt

@@ -0,0 +1,13 @@
+--TEST--
+#[NotSerializable] interface behavior
+--FILE--
+<?php
+
+#[NotSerializable]
+interface Foo {
+
+}
+
+?>
+--EXPECTF--
+Fatal error: Cannot apply #[\NotSerializable] to interface Foo in %s on line %d

Zend/tests/attributes/not_serializable/004-traits.phpt

@@ -0,0 +1,13 @@
+--TEST--
+#[NotSerializable] traits behavior
+--FILE--
+<?php
+
+#[NotSerializable]
+trait Foo {
+
+}
+
+?>
+--EXPECTF--
+Fatal error: Cannot apply #[\NotSerializable] to trait Foo in %s on line %d

Zend/tests/attributes/not_serializable/005-enum.phpt

@@ -0,0 +1,29 @@
+--TEST--
+#[NotSerializable] enum behavior
+--FILE--
+<?php
+
+#[NotSerializable]
+enum Foo {
+    case BAR;
+}
+
+try {
+    $s = serialize(Foo::BAR);
+    echo "Should not reach here\n";
+} catch (Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+
+try {
+    $data = 'E:7:"Foo:BAR";';
+    unserialize($data);
+    echo "Should not reach here\n";
+} catch (Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECTF--
+Serialization of 'Foo' is not allowed
+Unserialization of 'Foo' is not allowed

Zend/zend_attributes.c

@@ -33,6 +33,7 @@ ZEND_API zend_class_entry *zend_ce_override;
 ZEND_API zend_class_entry *zend_ce_deprecated;
 ZEND_API zend_class_entry *zend_ce_nodiscard;
 ZEND_API zend_class_entry *zend_ce_delayed_target_validation;
+ZEND_API zend_class_entry *zend_ce_not_serializable;
 
 static zend_object_handlers attributes_object_handlers_sensitive_parameter_value;
 
@@ -242,6 +243,18 @@ static zend_string *validate_nodiscard(
 	return NULL;
 }
 
+static zend_string *validate_not_serializable(
+	zend_attribute *attr, uint32_t target, zend_class_entry *scope)
+{
+	if (scope->ce_flags & (ZEND_ACC_TRAIT|ZEND_ACC_INTERFACE)) {
+		const char *type = zend_get_object_type_case(scope, false);
+		return zend_strpprintf(0, "Cannot apply #[\\NotSerializable] to %s %s", type, ZSTR_VAL(scope->name));
+	}
+
+	scope->ce_flags |= ZEND_ACC_NOT_SERIALIZABLE;
+	return NULL;
+}
+
 ZEND_METHOD(NoDiscard, __construct)
 {
 	zend_string *message = NULL;
@@ -606,6 +619,10 @@ void zend_register_attribute_ce(void)
 
 	zend_ce_delayed_target_validation = register_class_DelayedTargetValidation();
 	attr = zend_mark_internal_attribute(zend_ce_delayed_target_validation);
+
+	zend_ce_not_serializable = register_class_NotSerializable();
+	attr = zend_mark_internal_attribute(zend_ce_not_serializable);
+	attr->validator = validate_not_serializable;
 }
 
 void zend_attributes_shutdown(void)

Zend/zend_attributes.stub.php

@@ -103,3 +103,9 @@ public function __construct(?string $message = null) {}
  */
 #[Attribute(Attribute::TARGET_ALL)]
 final class DelayedTargetValidation {}
+
+/**
+ * @strict-properties
+ */
+#[Attribute(Attribute::TARGET_CLASS)]
+final class NotSerializable {}

ext/standard/tests/serialize/ref_to_failed_serialize.phpt

@@ -3,7 +3,7 @@ References to objects for which Serializable::serialize() returned NULL should u
 --FILE--
 <?php
 
-class NotSerializable implements Serializable {
+class NotSerializableCls implements Serializable {
     public function serialize() {
         return null;
     }
@@ -12,7 +12,7 @@ class NotSerializable implements Serializable {
     }
 }
 
-$obj = new NotSerializable();
+$obj = new NotSerializableCls();
 $data = [$obj, $obj];
 var_dump($s = serialize($data));
 var_dump(unserialize($s));

ext/standard/var_unserializer.re

@@ -1394,6 +1394,12 @@ object ":" uiv ":" ["]	{
 		goto fail;
 	}
 
+	if (ce->ce_flags & ZEND_ACC_NOT_SERIALIZABLE) {
+        zend_throw_exception_ex(NULL, 0, "Unserialization of '%s' is not allowed",
+            ZSTR_VAL(ce->name));
+        goto fail;
+    }
+
 	YYCURSOR += 2;
 	*p = YYCURSOR;