El Mehdi Abenhazou e8c101fac8 fix(TaskProcessing): restrict allowed_classes in Manager cache deserialization ...

The availableTaskTypes cache stores serialized arrays containing
ShapeDescriptor objects, ShapeEnumValue objects, and EShapeType enum
values. The unserialize() call did not restrict which classes could
be instantiated.

Restrict deserialization to the three known types:
- OCP\TaskProcessing\ShapeDescriptor
- OCP\TaskProcessing\ShapeEnumValue
- OCP\TaskProcessing\EShapeType

This prevents PHP Object Injection if an attacker gains write access
to the distributed cache backend.

Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>

2026-06-04 10:49:23 +02:00

..

Db

chore: Remove types from const properties

2026-06-02 09:46:16 +02:00

Manager.php

fix(TaskProcessing): restrict allowed_classes in Manager cache deserialization

2026-06-04 10:49:23 +02:00

RemoveOldTasksBackgroundJob.php

chore: Apply new coding standard to all files

2026-06-01 13:46:39 +02:00

SynchronousBackgroundJob.php

chore: Apply new coding standard to all files

2026-06-01 13:46:39 +02:00