X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=CRM%2FUtils%2FAutoClean.php;h=c2c21dc1849a2222fced03049b4d99de5f7a1afa;hb=1af6842deebba55c837043f69a1a8f06d710e497;hp=558ca34adb7ff157ca04ad43b869c070335432e0;hpb=594eddc519b33992b5f046fa91627c87966e2527;p=civicrm-core.git

diff --git a/CRM/Utils/AutoClean.php b/CRM/Utils/AutoClean.php
index 558ca34adb..c2c21dc184 100644
--- a/CRM/Utils/AutoClean.php
+++ b/CRM/Utils/AutoClean.php
@@ -102,4 +102,24 @@ class CRM_Utils_AutoClean {
     \Civi\Core\Resolver::singleton()->call($this->callback, $this->args);
   }
 
+  /**
+   * Prohibit (de)serialization of CRM_Utils_AutoClean.
+   *
+   * The generic nature of AutoClean makes it a potential target for escalating
+   * serialization vulnerabilities, and there's no good reason for serializing it.
+   */
+  public function __sleep() {
+    throw new \RuntimeException("CRM_Utils_AutoClean is a runtime helper. It is not intended for serialization.");
+  }
+
+  /**
+   * Prohibit (de)serialization of CRM_Utils_AutoClean.
+   *
+   * The generic nature of AutoClean makes it a potential target for escalating
+   * serialization vulnerabilities, and there's no good reason for deserializing it.
+   */
+  public function __wakeup() {
+    throw new \RuntimeException("CRM_Utils_AutoClean is a runtime helper. It is not intended for deserialization.");
+  }
+
 }