TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:09 +02:00
commit af8cc155b5
6818 changed files with 642608 additions and 0 deletions
@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Core\Serializer;
+
+use Symfony\Component\DependencyInjection\Attribute\Autoconfigure;
+use TYPO3\CMS\Core\Crypto\HashAlgo;
+use TYPO3\CMS\Core\Crypto\HashService;
+use TYPO3\CMS\Core\Exception\Crypto\InvalidHashStringException;
+use TYPO3\CMS\Core\Serializer\Exception\DeserializerException;
+
+/**
+ * @internal Only to be used by TYPO3 core
+ */
+#[Autoconfigure(public: true)]
+final readonly class AuthenticatedMessageDeserializer
+{
+    private const HASH_ALGO = HashAlgo::SHA3_384;
+
+    public function __construct(
+        private HashService $hashService,
+        private DeserializationService $deserializationService,
+    ) {}
+
+    public function serialize(mixed $payload, string $additionalSecret): string
+    {
+        return $this->hashService->appendHmac(
+            serialize($payload),
+            $additionalSecret,
+            self::HASH_ALGO
+        );
+    }
+
+    public function deserialize(string $payload, string $additionalSecret): mixed
+    {
+        try {
+            $serialized = $this->hashService->validateAndStripHmac(
+                $payload,
+                $additionalSecret,
+                self::HASH_ALGO
+            );
+        } catch (InvalidHashStringException $e) {
+            $classNames = $this->deserializationService->parseClassNames($payload);
+            // in case the payload does not contain any class names, continue with
+            // a secure deserialization attempt, not allowing any class names
+            if ($classNames === []) {
+                return @unserialize($payload, ['allowed_classes' => false]);
+            }
+            throw new DeserializerException(
+                'Authenticated Message Deserialization failed',
+                1780317744,
+                $e
+            );
+        }
+        // explicitly allowing all classes here after successful HMAC validation
+        /* @phpstan-ignore unserialize.allowedClasses.insecure (Integrity check already happens via HMAC validation) */
+        return unserialize($serialized, ['allowed_classes' => true]);
+    }
+}