FileStorage and (un)serialization

[Ludoi]

Would it be possible to enhance the FileStorage in a way that instead of direct usage of functions serialize and unserialize it uses some protected methods which would allow to inherit from the class and only change the way how the serialization/unserialization is done?

I.e. currently I use PECL igbinary_serialize/igbinary_unserialize as it seems to be more effective than PHPs own serialize/unserialize. I created my own storage by copying the FileStorage and exchanged the functions, but it would be much nicer to just inherit from FileStorage and redefine the serialize/unserialize methods.

Thank you.

Just FYI - Nette.Database.Structure cached file was 380 kB using serialize, while it is 43 kB using igbinary_serialize.

[traxeon]

I'm using Laravel 12 and this library is part of the build.
Snyk flags this as a medium security issue: https://cwe.mitre.org/data/definitions/502.html
Deserialization of Untrusted Data
This is the code block:

 /**
	 * Reads cache data from disk.
	 */
	protected function readMetaAndLock(string $file, int $lock): ?array
	{
		$handle = @fopen($file, 'r+b'); // @ - file may not exist
		if (!$handle) {
			return null;
		}

		flock($handle, $lock);

		$size = (int) stream_get_contents($handle, self::MetaHeaderLen);
		if ($size) {
			$meta = stream_get_contents($handle, $size, self::MetaHeaderLen);
			$meta = unserialize($meta);
			$meta[self::File] = $file;
			$meta[self::Handle] = $handle;
			return $meta;
		}

		flock($handle, LOCK_UN);
		fclose($handle);
		return null;
	}