{"record":{"id":"2a7d15614442920b","repo":"symfony/process","slug":"cannot-unserialize-symfony-component-process-pipes","errorCode":null,"errorMessage":"Cannot unserialize Symfony\\Component\\Process\\Pipes\\WindowsPipes","messagePattern":"Cannot unserialize Symfony\\\\Component\\\\Process\\\\Pipes\\\\WindowsPipes","errorType":"exception","errorClass":"BadMethodCallException","httpStatus":null,"severity":"error","filePath":"Pipes/WindowsPipes.php","lineNumber":97,"sourceCode":"                    $this->fileHandles[$pipe] = $h;\n                    $this->files[$pipe] = $file;\n                }\n                break;\n            }\n            restore_error_handler();\n        }\n\n        parent::__construct($input);\n    }\n\n    public function __serialize(): array\n    {\n        throw new \\BadMethodCallException('Cannot serialize '.__CLASS__);\n    }\n\n    public function __unserialize(array $data): void\n    {\n        throw new \\BadMethodCallException('Cannot unserialize '.__CLASS__);\n    }\n\n    public function __destruct()\n    {\n        $this->close();\n    }\n\n    public function getDescriptors(): array\n    {\n        if (!$this->haveReadSupport) {\n            $nullstream = fopen('NUL', 'c');\n\n            return [\n                ['pipe', 'r'],\n                $nullstream,\n                $nullstream,\n            ];\n        }","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/symfony/process/blob/99b85026db14a68f02c6f3eeb01a1170ca25c491/Pipes/WindowsPipes.php#L79-L115","documentation":"WindowsPipes uses temporary files as pipe buffers and cannot be serialized; __unserialize() is a sentinel that always throws BadMethodCallException whenever a serialized WindowsPipes instance is unserialized, so serialization round-trips of this object are unsupported by design.","triggerScenarios":"unserialize() on data containing a WindowsPipes object — from stale caches, crafted payloads, or payloads created before this guard existed.","commonSituations":"Restoring cached sessions on Windows that embedded live Process objects; handling untrusted serialized input.","solutions":["Recreate the Process from stored configuration instead of unserializing it","Use unserialize() with ['allowed_classes' => false] or explicit class whitelist to avoid instantiating pipes","Purge old cache entries containing Process objects"],"exampleFix":"// before\n$data = unserialize($cached);\n// after\n$data = unserialize($cached, ['allowed_classes' => [\\stdClass::class]]);","handlingStrategy":"type-guard","validationCode":"$data = unserialize($blob, ['allowed_classes' => false]);","typeGuard":"function safeUnserialize(string $blob): mixed { return unserialize($blob, ['allowed_classes' => false]); }","tryCatchPattern":"try { $obj = unserialize($blob); } catch (\\BadMethodCallException $e) { $obj = null; }","preventionTips":["Whitelist classes when unserializing","Purge caches created with embedded Process objects","Store descriptors and recreate processes on demand"],"tags":["serialization","windows","process","unserialize"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"99b85026db14a68f02c6f3eeb01a1170ca25c491","analyzedAt":"2026-09-14T11:23:33.683Z","contentChangedAt":"2026-09-14T11:23:33.683Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}