{"record":{"id":"4846019831dc7fb6","repo":"symfony/process","slug":"cannot-unserialize-symfony-component-process-process","errorCode":null,"errorMessage":"Cannot unserialize Symfony\\Component\\Process\\Process","messagePattern":"Cannot unserialize Symfony\\\\Component\\\\Process\\\\Process","errorType":"exception","errorClass":"BadMethodCallException","httpStatus":null,"severity":"error","filePath":"Process.php","lineNumber":223,"sourceCode":"     *\n     * @throws LogicException When proc_open is not installed\n     */\n    public static function fromShellCommandline(string $command, ?string $cwd = null, ?array $env = null, mixed $input = null, ?float $timeout = 60): static\n    {\n        $process = new static([], $cwd, $env, $input, $timeout);\n        $process->commandline = $command;\n\n        return $process;\n    }\n\n    public function __serialize(): array\n    {\n        throw new \\BadMethodCallException('Cannot serialize '.__CLASS__);\n    }\n\n    public function __unserialize(array $data): void\n    {\n        throw new \\BadMethodCallException('Cannot unserialize '.__CLASS__);\n    }\n\n    public function __destruct()\n    {\n        if ($this->options['create_new_console'] ?? false) {\n            $this->processPipes->close();\n        } else {\n            $this->stop(0);\n        }\n    }\n\n    public function __clone()\n    {\n        $this->resetProcessData();\n    }\n\n    /**\n     * Runs the process.","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/symfony/process/blob/99b85026db14a68f02c6f3eeb01a1170ca25c491/Process.php#L205-L241","documentation":"Process::__unserialize() is the symmetric guard: unserialize() must never reconstruct a Process object because it would refer to a dead/unknown OS process and invalid pipe handles; it always throws BadMethodCallException.","triggerScenarios":"unserialize() of any payload containing a Symfony Process object — stale cache/session data, old queue messages, or attacker-controlled serialized input.","commonSituations":"Migrating code that used to (incorrectly) serialize Processes, loading old cache entries, processing untrusted serialized blobs.","solutions":["Stop embedding Process objects in serialized payloads; store process descriptions instead","Unserialize with ['allowed_classes' => false] or a strict whitelist","Purge/invalidate caches and queues holding serialized Process instances"],"exampleFix":"// before\n$task = unserialize($queueMessage);\n// after\n$task = unserialize($queueMessage, ['allowed_classes' => false]);","handlingStrategy":"type-guard","validationCode":"$data = unserialize($blob, ['allowed_classes' => false]);","typeGuard":"function safeUnserialize(string $blob): mixed { return unserialize($blob, ['allowed_classes' => false]); }","tryCatchPattern":"try { $obj = unserialize($blob); } catch (\\BadMethodCallException $e) { $obj = Process::fromShellCommandline($blob['command']); }","preventionTips":["Always pass allowed_classes when unserializing untrusted input","Treat Process as non-serializable by design; store an id/descriptor","Invalidate old serialized payloads after library upgrades"],"tags":["serialization","process","unserialize"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"99b85026db14a68f02c6f3eeb01a1170ca25c491","analyzedAt":"2026-09-14T11:23:33.683Z","contentChangedAt":"2026-09-14T11:23:33.683Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}