Magebean Logo Magebean
← Back to Baseline

MB-R017

AUTOMATED No unsafe deserialization

MB-C03 Secure Coding Practices High

No unsafe unserialize() usage detected; safe serialization methods in use.

Why it Matters

PHP’s unserialize() function can be very dangerous if it processes data that an attacker controls. Malicious serialized data can trigger “gadget chains” in PHP objects, leading to code execution, data theft, or denial of service.

In Magento, using JSON or Magento’s built-in serializers is much safer. If deserialization is unavoidable, strict class whitelists must be enforced. Without these protections, a single crafted payload could take full control of the store.

Verification Steps

Manual

# Search custom code for use of unserialize()
grep -R "unserialize(" app/code

# Also check for related risky functions
grep -R "serialize(" app/code

Remediation / Fix Guidance

  1. Avoid unserialize(). Use json_decode() and json_encode() for safe data handling.
  2. If deserialization is required, use Magento’s safe serializer (\Magento\Framework\Serialize\Serializer\Json or Serialize\SerializerInterface).
  3. Enforce strict class whitelists when deserialization cannot be avoided.
  4. Review all third-party extensions for unsafe serialization usage.

Examples

Fail Example
// Unsafe, unserializing user input
$data = unserialize($_POST['payload']);
Pass Example
// Safe, using JSON
$data = json_decode($_POST['payload'], true);

References