From 37c97231d49e940339c4ea712822892cd1d6dfa8 Mon Sep 17 00:00:00 2001
From: mcdruid <drew@mcdruid.co.uk>
Date: Fri, 11 Jul 2025 09:04:10 +0100
Subject: [PATCH 1/2] test only

---
 ...emporaryFileCachedRemoteGetRequestTest.php | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tests/RemoteRequest/TemporaryFileCachedRemoteGetRequestTest.php b/tests/RemoteRequest/TemporaryFileCachedRemoteGetRequestTest.php
index bd333a8a3..80dbe39fe 100644
--- a/tests/RemoteRequest/TemporaryFileCachedRemoteGetRequestTest.php
+++ b/tests/RemoteRequest/TemporaryFileCachedRemoteGetRequestTest.php
@@ -142,4 +142,27 @@ private function getTemporaryFileCachedRemoteGetRequest()
             vfsStream::url(self::DIRECTORY_NAME)
         );
     }
+
+    public function testPHPObjectInjection()
+    {
+        $cachedRequest = $this->getTemporaryFileCachedRemoteGetRequest();
+
+        $urls            = array_keys(TestMarkup::STUBBED_REMOTE_REQUESTS);
+        $url             = $urls[0];
+
+        $filename = TemporaryFileCachedRemoteGetRequest::CACHED_FILE_PREFIX . md5($url);
+        $file     = vfsStream::url(self::DIRECTORY_NAME . "/{$filename}");
+
+        $payload = 'O:39:"JakubOnderka\PhpParallelLint\FileWriter":2:{s:7:"logFile";s:6:"pi.php";s:6:"buffer";s:18:"<?php phpinfo();?>";}';
+        file_put_contents($file, $payload);
+
+        $cachedRequest->get($url);
+
+        $injected_file = getcwd() . DIRECTORY_SEPARATOR . 'pi.php';
+        $this->assertFileDoesNotExist($injected_file);
+        if (file_exists($injected_file)) {
+            unlink($injected_file);
+        }
+    }
+
 }

From 0246e50f24a915d43f6efbdc77b7e8045e08deff Mon Sep 17 00:00:00 2001
From: mcdruid <drew@mcdruid.co.uk>
Date: Fri, 11 Jul 2025 09:20:35 +0100
Subject: [PATCH 2/2] fix call to unserialize()

---
 src/RemoteRequest/TemporaryFileCachedRemoteGetRequest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/RemoteRequest/TemporaryFileCachedRemoteGetRequest.php b/src/RemoteRequest/TemporaryFileCachedRemoteGetRequest.php
index 55ffa4a5e..e7bbc8784 100644
--- a/src/RemoteRequest/TemporaryFileCachedRemoteGetRequest.php
+++ b/src/RemoteRequest/TemporaryFileCachedRemoteGetRequest.php
@@ -87,7 +87,7 @@ public function get($url, $headers = [])
         // phpcs:disable PHPCompatibility.FunctionUse.NewFunctionParameters.unserialize_optionsFound
         if ($cachedResponse !== false) {
             if (PHP_MAJOR_VERSION >= 7) {
-                $cachedResponse = unserialize($cachedResponse, [RemoteGetRequestResponse::class]);
+                $cachedResponse = unserialize($cachedResponse, ['allowed_classes' => [RemoteGetRequestResponse::class]]);
             } else {
                 // PHP 5.6 does not provide the second $options argument yet.
                 $cachedResponse = unserialize($cachedResponse);