rfc:deprecate-and-remove-ext-wddx

PHP RFC: Unbundle ext/wddx

Introduction

WDDX has been designed as programming language independent data exchange format for the web1). However, it never has been formally standardized, and it appears that it has been mostly superseeded by other data exchange formats such as JSON.

A particular problem is that PHP 4.0.0 added the ability to (de)serialize class instances2) including calls to _​_sleep() and __wakeup(), respectively. Therefore, wddx_deserialize() must not be called on untrusted user input to avoid remote code execution, basically defeating the purpose of WDDX. A former RFC proposed to “Deprecate class instance deserialization in WDDX”, but it has been withdrawn since that would break BC, and there seemed to be generally more consensus on deprecating the extension altogether.

Proposal

Therefore I suggest to unbundle ext/wddx. A secondary vote will be held about the detailed procedure:

  1. deprecate all functionality of the extension for PHP 7.4; move to PECL for PHP 8
  2. deprecate all functionality of the extension *and* move to PECL for PHP 7.4
  3. move the extension to PECL for PHP 7.4
  4. dump the extension for PHP 7.4 (unbundle without moving to PECL or somewhere else)

Backward Incompatible Changes

Obviously, code using the wddx extension would issue deprecation warnings, and/or would have to use the wddx extension from PECL (or somewhere else), or be rewritten.

Open Issues

  • None

Voting

The primary vote is about whether to unbundle ext/wddx, which requires a 2/3 majority.

Unbundle ext/wddx
Real name Yes No
ashnazg  
bwoebi  
carusogabriel  
cmb  
diegopires  
emir  
galvao  
girgias  
guilhermeblanco  
heiglandreas  
hywan  
jhdxr  
jpauli  
kalle  
kguest  
laruence  
lex  
malukenho  
mariano  
nikic  
ocramius  
petk  
rasmus  
remi  
reywob  
salathe  
sebastian  
stas  
trowski  
yunosh  
Final result: 30 0
This poll has been closed.


A secondary vote is held about the detailed procedure (see the proposal above). If the primary vote passes, the alternative with the most votes will be accepted.

Unbundle ext/wddx details
Real name depr. 7.4/move 8.0(1) depr. and move 7.4(2) move 7.4(3) dump 7.4(4)
ashnazg    
bwoebi    
carusogabriel    
chregu    
diegopires    
emir    
galvao    
girgias    
guilhermeblanco    
heiglandreas    
hywan    
jhdxr    
kalle    
kguest    
lex    
malukenho    
mariano    
nikic    
ocramius    
petk    
rasmus    
remi    
reywob    
salathe    
sebastian    
stas    
trowski    
yunosh    
Final result: 4 19 2 3
This poll has been closed.


Voting starts on 2019-01-17, and ends on 2019-01-31.

Patches and Tests

None, yet.

Implementation

  1. Applied to PHP-7.4

References

Rejected Features

None.

rfc/deprecate-and-remove-ext-wddx.txt · Last modified: by 127.0.0.1