Harden foramttedtextlogger against object injections

joomla · Nov 8, 2024 · 4982fc9 · 4982fc9
1 parent 30a64b3
commit 4982fc9
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/libraries/src/Log/Logger/FormattedtextLogger.php b/libraries/src/Log/Logger/FormattedtextLogger.php
@@ -144,6 +144,20 @@ public function __destruct()
         }
     }
 
+    /**
+     * Prevent object injection attacks by suppressing unserialization of instance with deferred rows
+     *
+     * @since  __DEPLOY_VERSION__
+     *
+     * @throws \Exception
+     */
+    public function __wakeup()
+    {
+        if ($this->defer && !empty($this->deferredEntries)) {
+            throw new \RuntimeException('Can not unserialize in defer mode');
+        }
+    }
+
     /**
      * Method to add an entry to the log.
      *