Laravel Unsafe Deserialization: How to Eliminate unserialize() and Prevent Object Injection

The Problem

How to Fix

1. 1

   Find all unserialize() calls

   Search your codebase:

   grep -rn 'unserialize(' app/ routes/ --include='*.php'

   Also search for related functions:

   grep -rn 'unserialize\|deserialize\|object_decode' app/ --include='*.php'

   For each occurrence, trace whether the input could originate from a user request, database field populated by users, cache, or external API.

2. 2

   Replace with json_decode() where possible

   Most serialized data can use JSON instead:

   // BEFORE — unsafe
   $data = unserialize($request->input('data'));

   // AFTER — safe
   $data = json_decode($request->input('data'), true);

   JSON cannot instantiate PHP objects, eliminating the object injection vector entirely. Update both the serialization and deserialization sides:

   // Saving
   $encoded = json_encode($data);

   // Loading
   $decoded = json_decode($encoded, true);

3. 3

   If unserialize() is unavoidable, restrict allowed classes

   PHP 7+ supports an allowed_classes option:

   // Only allow specific classes
   $data = unserialize($serialized, [
       'allowed_classes' => [MyDTO::class, Collection::class],
   ]);

   // Or allow no classes at all (safest)
   $data = unserialize($serialized, [
       'allowed_classes' => false,
   ]);

   With allowed_classes set to false, any serialized objects are converted to __PHP_Incomplete_Class, preventing method execution.

How to Verify

php artisan stackshield:scan --check=SS043

Prevention

Frequently Asked Questions