$allowedClasses * @throws DeserializerException */ public function deserialize(string $payload, array $allowedClasses): mixed { // When allowing inheritance, extract all class names from payload and validate them $classNames = $this->deserializationService->parseClassNames($payload); foreach ($classNames as $className) { if (!$this->isInstanceOf($className, $allowedClasses)) { throw new DeserializerException('Invalid class name "' . $className . '" found in payload', 1767987405); } // Add the class if it's a valid subclass of any allowed class if (!in_array($className, $allowedClasses, true)) { $allowedClasses[] = $className; } } return $this->deserializationService->deserialize($payload, $allowedClasses); } /** * @return list * @deprecated use DeserializationService::parseClassNames instead; will be removed in v15 */ public function parseClassNames(string $payload): array { return $this->deserializationService->parseClassNames($payload); } /** * @param list $allowedClassNames */ private function isInstanceOf(string $className, array $allowedClassNames): bool { foreach ($allowedClassNames as $allowedClassName) { if (is_a($className, $allowedClassName, true) || is_subclass_of($className, $allowedClassName)) { return true; } } return false; } }