Issue #3525170 by benjifisher, catch, greggles, larowlan, mcdruid: Clean up...

Issue #3525170 by benjifisher, catch, greggles, larowlan, mcdruid: Clean up unserialize() in the migration modules

core/modules/migrate/migrate.api.php

@@ -156,7 +156,7 @@ function hook_migrate_prepare_row(Row $row, MigrateSourceInterface $source, Migr
   if ($migration->id() == 'd6_filter_formats') {
     $value = $source->getDatabase()->query('SELECT [value] FROM {variable} WHERE [name] = :name', [':name' => 'my_module_filter_foo_' . $row->getSourceProperty('format')])->fetchField();
     if ($value) {
-      $row->setSourceProperty('settings:my_module:foo', unserialize($value));
+      $row->setSourceProperty('settings:my_module:foo', unserialize($value, ['allowed_classes' => FALSE]));
     }
   }
 }
@@ -179,7 +179,7 @@ function hook_migrate_prepare_row(Row $row, MigrateSourceInterface $source, Migr
 function hook_migrate_MIGRATION_ID_prepare_row(Row $row, MigrateSourceInterface $source, MigrationInterface $migration) {
   $value = $source->getDatabase()->query('SELECT [value] FROM {variable} WHERE [name] = :name', [':name' => 'my_module_filter_foo_' . $row->getSourceProperty('format')])->fetchField();
   if ($value) {
-    $row->setSourceProperty('settings:my_module:foo', unserialize($value));
+    $row->setSourceProperty('settings:my_module:foo', unserialize($value, ['allowed_classes' => FALSE]));
   }
 }
 

core/modules/migrate/src/Plugin/Discovery/AnnotatedClassDiscoveryAutomatedProviders.php

@@ -65,7 +65,7 @@ public function getDefinitions() {
                 if (isset($cached['id'])) {
                   // Explicitly unserialize this to create a new object
                   // instance.
-                  $definitions[$cached['id']] = unserialize($cached['content']);
+                  $definitions[$cached['id']] = unserialize($cached['content'], ['allowed_classes' => FALSE]);
                 }
                 continue;
               }

core/modules/migrate/src/Plugin/migrate/source/ConfigEntity.php

@@ -71,7 +71,8 @@ public function query() {
    * {@inheritdoc}
    */
   public function prepareRow(Row $row) {
-    $row->setSourceProperty('data', unserialize($row->getSourceProperty('data')));
+    // @see \Drupal\Core\Config\DatabaseStorage::decode()
+    $row->setSourceProperty('data', unserialize($row->getSourceProperty('data'), ['allowed_classes' => FALSE]));
     return parent::prepareRow($row);
   }
 

core/modules/migrate_drupal/src/Plugin/migrate/source/DrupalSqlBase.php

@@ -173,7 +173,7 @@ protected function variableGet($name, $default) {
     catch (\Exception) {
       $result = FALSE;
     }
-    return $result !== FALSE ? unserialize($result) : $default;
+    return $result !== FALSE ? unserialize($result, ['allowed_classes' => ['stdClass']]) : $default;
   }
 
   /**

core/modules/migrate_drupal/src/Plugin/migrate/source/Variable.php

@@ -129,7 +129,10 @@ protected function values() {
     // Create an ID field so we can record migration in the map table.
     // Arbitrarily, use the first variable name.
     $values['id'] = reset($this->variables);
-    return $values + array_map('unserialize', $this->prepareQuery()->execute()->fetchAllKeyed());
+    return $values + array_map(
+      fn($data) => unserialize($data, ['allowed_classes' => FALSE]),
+      $this->prepareQuery()->execute()->fetchAllKeyed(),
+    );
   }
 
   /**

core/modules/migrate_drupal/src/Plugin/migrate/source/VariableMultiRow.php

@@ -66,7 +66,7 @@ public function fields() {
    */
   public function prepareRow(Row $row) {
     if ($value = $row->getSourceProperty('value')) {
-      $row->setSourceProperty('value', unserialize($value));
+      $row->setSourceProperty('value', unserialize($value, ['allowed_classes' => FALSE]));
     }
     return parent::prepareRow($row);
   }

core/modules/migrate_drupal/src/Plugin/migrate/source/d6/VariableTranslation.php

@@ -78,7 +78,7 @@ protected function values() {
     foreach ($result as $i18n_variable) {
       foreach ($values as $key => $value) {
         if ($values[$key]['language'] === $i18n_variable->language) {
-          $values[$key][$i18n_variable->name] = unserialize($i18n_variable->value);
+          $values[$key][$i18n_variable->name] = unserialize($i18n_variable->value, ['allowed_classes' => FALSE]);
           break;
         }
       }

core/modules/migrate_drupal/src/Plugin/migrate/source/d7/VariableTranslation.php

@@ -78,7 +78,7 @@ protected function values() {
       foreach ($values as $key => $value) {
         if ($values[$key]['language'] === $variable_store['realm_key']) {
           if ($variable_store['serialized']) {
-            $values[$key][$variable_store['name']] = unserialize($variable_store['value']);
+            $values[$key][$variable_store['name']] = unserialize($variable_store['value'], ['allowed_classes' => FALSE]);
             break;
           }
           else {

core/modules/migrate_drupal/src/Plugin/migrate/source/d8/Config.php

@@ -88,7 +88,8 @@ public function query() {
    * {@inheritdoc}
    */
   public function prepareRow(Row $row) {
-    $row->setSourceProperty('data', unserialize($row->getSourceProperty('data')));
+    // @see \Drupal\Core\Config\DatabaseStorage::decode()
+    $row->setSourceProperty('data', unserialize($row->getSourceProperty('data'), ['allowed_classes' => FALSE]));
     return parent::prepareRow($row);
   }
 

core/modules/migrate_drupal_ui/src/Form/ReviewForm.php

@@ -286,7 +286,7 @@ protected function prepareOutput(array $migration_state) {
     foreach ($migration_state as $source_machine_name => $destination_modules) {
       $data = NULL;
       if (isset($this->systemData['module'][$source_machine_name]['info'])) {
-        $data = unserialize($this->systemData['module'][$source_machine_name]['info']);
+        $data = unserialize($this->systemData['module'][$source_machine_name]['info'], ['allowed_classes' => FALSE]);
       }
       $source_module_name = $data['name'] ?? $source_machine_name;
       // Get the names of all the destination modules.

core/modules/migrate_drupal_ui/tests/src/Functional/MigrateUpgradeTestBase.php

@@ -269,7 +269,7 @@ protected function assertUpgrade(array $entity_counts) {
         // Convert $source_id into a keyless array so that
         // \Drupal\migrate\Plugin\migrate\id_map\Sql::getSourceHash() works as
         // expected.
-        $source_id_values = array_values(unserialize($source_id));
+        $source_id_values = array_values(unserialize($source_id, ['allowed_classes' => FALSE]));
         $row = $id_map->getRowBySource($source_id_values);
         $destination = serialize($id_map->currentDestination());
         $message = "Migration of $source_id to $destination as part of the {$migration->id()} migration. The source row status is " . $row['source_row_status'];