yiisoft/yii — pull request #2371 by stephen-164 (2013-04-18 19:57:48+00:00)
Title: Compartmentalise serialisation-to-cookie in CWebUser

The current implementation of the save-state-to-cookie implementation uses PHP `serialize()` of a stdClass object, and conversely calls `unserialize()` on user-supplied data from the cookie. Calling `unserialize()` on user-supplied data is high-risk (http://heine.familiedeelstra.com/security/unserialize etc): basically this behaviour allows an attacker to establish an instance of any class, with any data in member variables, and be sure that the `__destruct()` method will be called on it, so if a separate class in the framework contains a `__destruct()` call which has sensitive behaviour (such as writing variable data to disk, or performing database queries), exploits up to and including arbitrary shell execution are opened.

I don't think Yii core is at risk to this attack because there are no dangerous destructors in the framework, but *any* dangerous class which can be autoloaded (eg in extensions or vendors) can be used, so I for one would rather not have `unserialize()` called on user data on my sites; an acceptable alternative for me (and one which is also useful separately since I access the state cookie client-side with javascript) is to JSON-encode the data rather than serialising it.

This change abstracts the `serialize()` and `unserialize()` calls in CWebUser into separate protected methods so they can be easily overridden in subclasses without needing to duplicate big chunks of code in saveToCookie(), renewCookie() and restoreFromCookie().