Harden against serialization vulnerabilities (#46)

diff --git a/CRM/Utils/AutoClean.php b/CRM/Utils/AutoClean.php
index 558ca34adb7ff157ca04ad43b869c070335432e0..c2c21dc1849a2222fced03049b4d99de5f7a1afa 100644 (file)
--- a/CRM/Utils/AutoClean.php
+++ b/CRM/Utils/AutoClean.php
@@ -102,4 +102,24 @@ class CRM_Utils_AutoClean {
     \Civi\Core\Resolver::singleton()->call($this->callback, $this->args);
   }
 
+  /**
+   * Prohibit (de)serialization of CRM_Utils_AutoClean.
+   *
+   * The generic nature of AutoClean makes it a potential target for escalating
+   * serialization vulnerabilities, and there's no good reason for serializing it.
+   */
+  public function __sleep() {
+    throw new \RuntimeException("CRM_Utils_AutoClean is a runtime helper. It is not intended for serialization.");
+  }
+
+  /**
+   * Prohibit (de)serialization of CRM_Utils_AutoClean.
+   *
+   * The generic nature of AutoClean makes it a potential target for escalating
+   * serialization vulnerabilities, and there's no good reason for deserializing it.
+   */
+  public function __wakeup() {
+    throw new \RuntimeException("CRM_Utils_AutoClean is a runtime helper. It is not intended for deserialization.");
+  }
+
 }