{"record":{"id":"c8f051123ddfa093","repo":"symfony/process","slug":"cannot-unserialize-symfony-component-process-pipes-unixpipes","errorCode":null,"errorMessage":"Cannot unserialize Symfony\\Component\\Process\\Pipes\\UnixPipes","messagePattern":"Cannot unserialize Symfony\\\\Component\\\\Process\\\\Pipes\\\\UnixPipes","errorType":"exception","errorClass":"BadMethodCallException","httpStatus":null,"severity":"error","filePath":"Pipes/UnixPipes.php","lineNumber":41,"sourceCode":"class UnixPipes extends AbstractPipes\n{\n    public function __construct(\n        private ?bool $ttyMode,\n        private bool $ptyMode,\n        mixed $input,\n        private bool $haveReadSupport,\n    ) {\n        parent::__construct($input);\n    }\n\n    public function __serialize(): array\n    {\n        throw new \\BadMethodCallException('Cannot serialize '.__CLASS__);\n    }\n\n    public function __unserialize(array $data): void\n    {\n        throw new \\BadMethodCallException('Cannot unserialize '.__CLASS__);\n    }\n\n    public function __destruct()\n    {\n        $this->close();\n    }\n\n    public function getDescriptors(): array\n    {\n        if (!$this->haveReadSupport) {\n            $nullstream = fopen('/dev/null', 'c');\n\n            return [\n                ['pipe', 'r'],\n                $nullstream,\n                $nullstream,\n            ];\n        }","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/symfony/process/blob/99b85026db14a68f02c6f3eeb01a1170ca25c491/Pipes/UnixPipes.php#L23-L59","documentation":"The counterpart of __serialize: unserializing data into a UnixPipes instance would fabricate an object referencing nonexistent OS resources, so __unserialize() unconditionally throws BadMethodCallException.","triggerScenarios":"unserialize() of a payload that contains a UnixPipes object (e.g. a payload crafted or stored when serialization was previously allowed, or attacker-supplied serialized data).","commonSituations":"Deserializing cached/session data that embedded a Process object; processing untrusted serialized blobs containing pipe objects.","solutions":["Remove the offending entry from the serialized payload and recreate the Process instead","Sanitize/unserialize with allowed_classes restrictions so pipes classes are rejected cleanly","Regenerate the cache/session data after upgrading code that previously stored live Process objects"],"exampleFix":"// before\n$data = unserialize($blob);\n// after\n$data = unserialize($blob, ['allowed_classes' => false]);","handlingStrategy":"type-guard","validationCode":"$data = unserialize($blob, ['allowed_classes' => false]);","typeGuard":"function safeUnserialize(string $blob): mixed { return unserialize($blob, ['allowed_classes' => false]); }","tryCatchPattern":"try { $obj = unserialize($blob); } catch (\\BadMethodCallException $e) { $obj = null; }","preventionTips":["Unserialize with allowed_classes restrictions","Never cache live pipe objects","Rebuild Processes from stored configuration instead of unserializing them"],"tags":["serialization","process","pipes","unserialize"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"99b85026db14a68f02c6f3eeb01a1170ca25c491","analyzedAt":"2026-09-14T11:23:33.683Z","contentChangedAt":"2026-09-14T11:23:33.683Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}