- Issue created by @cmlara
- 🇫🇷France fgm Paris, France
One issue remains with PHP serialization: it has obvious advantages like speed and being able to (de)serialize class objects, but that it also a security issue because payloads can be crafted that can be dangerous. In comparison, JSON is basically safe by construction.
Also, it means Drupal can't create jobs to be handled by non-PHP workers, which is getting more common over time (e.g. Go workers).
- 🇺🇸United States cmlara
but that it also a security issue because payloads can be crafted that can be dangerous.
Indeed, that has been the one negative I haven’t liked about converting 4.x to no longer be JSON. Unfortunately it’s what we are forced with until core comes up with a method for queue gets to specify an allowed class (not aware of any feature request for this though perhaps there should be?).
Also, it means Drupal can't create jobs to be handled by non-PHP workers
Similar complaint, I haven’t fully embraced 4.x as my only apps using 3.x needed to feed a python consumer. I see ✨ Allow serialization mode to be configured per queue. Active as the solution for that (php for most queues, json for specific queues feeding out to 3rd party solutions or ingesting from 3rd parties)