fix unsafe unserialize usage