Documentation
¶
Overview ¶
Package phpserialize decodes a PHP serialize() string into its object tree for PHP Object Injection (POI) triage.
PHP's serialize() / unserialize() is the wire format behind session files, signed/unsigned cookies, caches, and many framework "remember me" tokens. If an app calls unserialize() on attacker-controlled data, an attacker can inject an arbitrary object (O:…) whose magic methods (__wakeup / __destruct / __toString) fire a "POP chain" — the phpggc gadget families (Monolog, Guzzle, Laravel/Illuminate, Symfony, Doctrine, WordPress, …) turn that into RCE / file-write / SSRF. The analyst question is "does this blob instantiate objects, of what classes, and is a known gadget present?".
This parses the documented serialize() grammar — N (null), b (bool), i (int), d (double), s (string, byte-length-prefixed), a (array), O (object), C (custom/Serializable), E (enum, PHP 8.1), r/R (reference) — into a JSON-friendly value tree, collecting every object class name, de-mangling private (\0Class\0prop) and protected (\0*\0prop) property keys, flagging any class in the known gadget set, and noting that the mere presence of an object is an object-injection surface. It never instantiates anything.
No confidently-wrong output: the grammar is parsed deterministically; a malformed or unsupported construct stops the parse with `truncated:true` and a note, returning the (correctly parsed) tree so far — it never guesses past an ambiguity. Recursion is depth-capped against a nested-array/object bomb.
Wrap-vs-native: native — a recursive-descent parser of the documented text grammar, stdlib only, no new go.mod dependency. Anchored to hand-built and published phpggc-style vectors (see the test).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
Format string `json:"format"`
Type string `json:"type"`
Value any `json:"value"`
Classes []string `json:"classes,omitempty"`
GadgetClasses []string `json:"gadget_classes,omitempty"`
ObjectInjection bool `json:"object_injection_surface"`
Truncated bool `json:"truncated,omitempty"`
Suspicious bool `json:"suspicious"`
Note string `json:"note"`
}
Result is the decoded PHP serialized value.
Source Files