[WIP] Handle unserialize() failures gracefully

src/Adapter/Apc/ApcCachePool.php

@@ -44,12 +44,18 @@ protected function fetchObjectFromCache($key)
             return [false, null, [], null];
         }
 
-        $success   = false;
-        $cacheData = apc_fetch($key, $success);
+        $success = false;
+
+        try {
+            $cacheData = apc_fetch($key, $success);
+        } catch (\Error $e) {
+            throw new \ErrorException($e->getMessage(), $e->getCode(), E_ERROR, $e->getFile(), $e->getLine());
+        }
+
         if (!$success) {
             return [false, null, [], null];
         }
-        list($data, $tags, $timestamp) = unserialize($cacheData);
+        list($data, $tags, $timestamp) = parent::unserialize($cacheData);
 
         return [$success, $data, $tags, $timestamp];
     }

src/Adapter/Apc/Tests/IntegrationPoolTest.php

@@ -12,10 +12,13 @@
 namespace Cache\Adapter\Apc\Tests;
 
 use Cache\Adapter\Apc\ApcCachePool;
+use Cache\Adapter\Common\Tests\Traits\TestNotUnserializableTrait;
 use Cache\IntegrationTests\CachePoolTest as BaseTest;
 
 class IntegrationPoolTest extends BaseTest
 {
+    use TestNotUnserializableTrait;
+
     protected $skippedTests = [
         'testExpiration'      => 'The cache expire at the next request.',
         'testSaveExpired'     => 'The cache expire at the next request.',

src/Adapter/Apcu/ApcuCachePool.php

@@ -44,12 +44,18 @@ protected function fetchObjectFromCache($key)
             return [false, null, [], null];
         }
 
-        $success   = false;
-        $cacheData = apcu_fetch($key, $success);
+        $success = false;
+
+        try {
+            $cacheData = apcu_fetch($key, $success);
+        } catch (\Error $e) {
+            throw new \ErrorException($e->getMessage(), $e->getCode(), E_ERROR, $e->getFile(), $e->getLine());
+        }
+
         if (!$success) {
             return [false, null, [], null];
         }
-        list($data, $tags, $timestamp) = unserialize($cacheData);
+        list($data, $tags, $timestamp) = parent::unserialize($cacheData);
 
         return [$success, $data, $tags, $timestamp];
     }

src/Adapter/Apcu/Tests/IntegrationPoolTest.php

@@ -12,10 +12,13 @@
 namespace Cache\Adapter\Apcu\Tests;
 
 use Cache\Adapter\Apcu\ApcuCachePool;
+use Cache\Adapter\Common\Tests\Traits\TestNotUnserializableTrait;
 use Cache\IntegrationTests\CachePoolTest as BaseTest;
 
 class IntegrationPoolTest extends BaseTest
 {
+    use TestNotUnserializableTrait;
+
     protected $skippedTests = [
         'testExpiration'      => 'The cache expire at the next request.',
         'testSaveExpired'     => 'The cache expire at the next request.',

src/Adapter/Common/AbstractCachePool.php

@@ -333,6 +333,7 @@ private function handleException(\Exception $e, $function)
         }
 
         $this->log($level, $e->getMessage(), ['exception' => $e]);
+
         if (!$e instanceof CacheException) {
             $e = new CachePoolException(sprintf('Exception thrown when executing "%s". ', $function), 0, $e);
         }
@@ -555,4 +556,46 @@ public function has($key)
     {
         return $this->hasItem($key);
     }
+
+    /**
+     * Like the native unserialize() function but throws an exception if anything goes wrong.
+     *
+     * @param string $value
+     *
+     * @throws \Exception
+     *
+     * @return mixed
+     */
+    protected static function unserialize($value)
+    {
+        if ('b:0;' === $value) {
+            return false;
+        }
+
+        $unserializeCallbackHandler = \ini_set('unserialize_callback_func', __CLASS__.'::handleUnserializeCallback');
+
+        try {
+            if (false !== $value = \unserialize($value)) {
+                return $value;
+            }
+
+            throw new \DomainException('Failed to unserialize cached value');
+        } catch (\Error $e) {
+            throw new \ErrorException($e->getMessage(), $e->getCode(), E_ERROR, $e->getFile(), $e->getLine());
+        } finally {
+            \ini_set('unserialize_callback_func', $unserializeCallbackHandler);
+        }
+    }
+
+    /**
+     * @internal
+     *
+     * @param string $class
+     *
+     * @throws \DomainException
+     */
+    public static function handleUnserializeCallback($class)
+    {
+        throw new \DomainException('Class not found: '.$class);
+    }
 }

src/Adapter/Common/CacheItem.php

@@ -62,6 +62,7 @@ class CacheItem implements PhpCacheItem
     /**
      * @param string        $key
      * @param \Closure|bool $callable or boolean hasValue
+     * @param mixed         $value
      */
     public function __construct($key, $callable = null, $value = null)
     {
@@ -241,8 +242,14 @@ private function initialize()
     {
         if ($this->callable !== null) {
             // $func will be $adapter->fetchObjectFromCache();
-            $func                      = $this->callable;
-            $result                    = $func();
+            $func = $this->callable;
+
+            try {
+                $result = $func();
+            } catch (\DomainException $exception) {
+                return;
+            }
+
             $this->hasValue            = $result[0];
             $this->value               = $result[1];
             $this->prevTags            = isset($result[2]) ? $result[2] : [];

src/Adapter/Common/Tests/Fixture/NotUnserializable.php

@@ -0,0 +1,25 @@
+<?php
+
+/*
+ * This file is part of php-cache organization.
+ *
+ * (c) 2015 Aaron Scherer <[email protected]>, Tobias Nyholm <[email protected]>
+ *
+ * This source file is subject to the MIT license that is bundled
+ * with this source code in the file LICENSE.
+ */
+
+namespace Cache\Adapter\Common\Tests\Fixture;
+
+class NotUnserializable implements \Serializable
+{
+    public function serialize()
+    {
+        return serialize(123);
+    }
+
+    public function unserialize($ser)
+    {
+        throw new \Exception(__CLASS__);
+    }
+}

src/Adapter/Common/Tests/Traits/TestNotUnserializableTrait.php

@@ -0,0 +1,50 @@
+<?php
+
+/*
+ * This file is part of php-cache organization.
+ *
+ * (c) 2015 Aaron Scherer <[email protected]>, Tobias Nyholm <[email protected]>
+ *
+ * This source file is subject to the MIT license that is bundled
+ * with this source code in the file LICENSE.
+ */
+
+namespace Cache\Adapter\Common\Tests\Traits;
+
+use Cache\Adapter\Common\Tests\Fixture\NotUnserializable;
+use Psr\Cache\CacheItemPoolInterface;
+
+trait TestNotUnserializableTrait
+{
+    public function testNotUnserializable()
+    {
+        if (isset($this->skippedTests[__FUNCTION__])) {
+            $this->markTestSkipped($this->skippedTests[__FUNCTION__]);
+
+            return;
+        }
+
+        $cache = $this->createCachePool();
+
+        $item = $cache->getItem('foo');
+        $cache->save($item->set(new NotUnserializable()));
+
+        $item = $cache->getItem('foo');
+        $this->assertFalse($item->isHit());
+
+        foreach ($cache->getItems(['foo']) as $item) {
+        }
+
+        $cache->save($item->set(new NotUnserializable()));
+
+        foreach ($cache->getItems(['foo']) as $item) {
+        }
+
+        $this->assertFalse($item->isHit());
+    }
+
+    /**
+     * @return CacheItemPoolInterface that is used in the tests
+     */
+    abstract public function createCachePool();
+}

src/Adapter/Doctrine/DoctrineCachePool.php

@@ -42,11 +42,27 @@ public function __construct(Cache $cache)
      */
     protected function fetchObjectFromCache($key)
     {
-        if (false === $data = $this->cache->fetch($key)) {
-            return [false, null, [], null];
-        }
+        $unserializeCallbackHandler = ini_set('unserialize_callback_func', parent::class.'::handleUnserializeCallback');
+
+        try {
+            if (false === $data = $this->cache->fetch($key)) {
+                return [false, null, [], null];
+            }
+
+            return parent::unserialize($data);
+        } catch (\Error $e) {
+            $trace = $e->getTrace();
 
-        return unserialize($data);
+            if (isset($trace[0]['function']) && !isset($trace[0]['class'])) {
+                if ($trace[0]['function'] === 'unserialize' || $trace[0]['function'] === 'apcu_fetch' || $trace[0]['function'] === 'apc_fetch') {
+                    throw new \ErrorException($e->getMessage(), $e->getCode(), E_ERROR, $e->getFile(), $e->getLine());
+                }
+            }
+
+            throw $e;
+        } finally {
+            ini_set('unserialize_callback_func', $unserializeCallbackHandler);
+        }
     }
 
     /**

src/Adapter/Doctrine/Tests/IntegrationPoolTest.php

@@ -11,9 +11,11 @@
 
 namespace Cache\Adapter\Doctrine\Tests;
 
+use Cache\Adapter\Common\Tests\Traits\TestNotUnserializableTrait;
 use Cache\IntegrationTests\CachePoolTest;
 
 class IntegrationPoolTest extends CachePoolTest
 {
     use CreatePoolTrait;
+    use TestNotUnserializableTrait;
 }

src/Adapter/Filesystem/FilesystemCachePool.php

@@ -64,7 +64,7 @@ protected function fetchObjectFromCache($key)
         $file  = $this->getFilePath($key);
 
         try {
-            $data = @unserialize($this->filesystem->read($file));
+            $data = parent::unserialize($this->filesystem->read($file));
             if ($data === false) {
                 return $empty;
             }
@@ -159,7 +159,7 @@ protected function getList($name)
             $this->filesystem->write($file, serialize([]));
         }
 
-        return unserialize($this->filesystem->read($file));
+        return parent::unserialize($this->filesystem->read($file));
     }
 
     /**

src/Adapter/Filesystem/Tests/FilesystemCachePoolTest.php

@@ -11,6 +11,8 @@
 
 namespace Cache\Adapter\Filesystem\Tests;
 
+use Cache\Adapter\Common\Tests\Traits\TestNotUnserializableTrait;
+
 use PHPUnit\Framework\TestCase;
 
 /**
@@ -19,6 +21,7 @@
 class FilesystemCachePoolTest extends TestCase
 {
     use CreatePoolTrait;
+    use TestNotUnserializableTrait;
 
     /**
      * @expectedException \Psr\Cache\InvalidArgumentException

src/Adapter/Illuminate/IlluminateCachePool.php

@@ -58,11 +58,27 @@ protected function storeItemInCache(PhpCacheItem $item, $ttl)
      */
     protected function fetchObjectFromCache($key)
     {
-        if (null === $data = $this->store->get($this->getHierarchyKey($key))) {
-            return [false, null, [], null];
-        }
+        $unserializeCallbackHandler = ini_set('unserialize_callback_func', parent::class.'::handleUnserializeCallback');
+
+        try {
+            if (null === $data = $this->store->get($this->getHierarchyKey($key))) {
+                return [false, null, [], null];
+            }
+
+            return parent::unserialize($data);
+        } catch (\Error $e) {
+            $trace = $e->getTrace();
+
+            if (isset($trace[0]['function']) && !isset($trace[0]['class'])) {
+                if ($trace[0]['function'] === 'apcu_fetch' || $trace[0]['function'] === 'apc_fetch') {
+                    throw new \ErrorException($e->getMessage(), $e->getCode(), E_ERROR, $e->getFile(), $e->getLine());
+                }
+            }
 
-        return unserialize($data);
+            throw $e;
+        } finally {
+            ini_set('unserialize_callback_func', $unserializeCallbackHandler);
+        }
     }
 
     /**
@@ -80,12 +96,15 @@ protected function clearOneObjectFromCache($key)
     {
         $path      = null;
         $keyString = $this->getHierarchyKey($key, $path);
+
         if ($path) {
             if ($this->store->get($path) === null) {
                 $this->store->put($path, 0, 0);
             }
+
             $this->store->increment($path);
         }
+
         $this->clearHierarchyKeyCache();
 
         return $this->store->forget($keyString);

src/Adapter/Illuminate/Tests/IntegrationPoolTest.php

@@ -11,9 +11,11 @@
 
 namespace Cache\Adapter\Illuminate\Tests;
 
+use Cache\Adapter\Common\Tests\Traits\TestNotUnserializableTrait;
 use Cache\IntegrationTests\CachePoolTest;
 
 class IntegrationPoolTest extends CachePoolTest
 {
     use CreatePoolTrait;
+    use TestNotUnserializableTrait;
 }

src/Adapter/Memcache/MemcacheCachePool.php

@@ -38,7 +38,7 @@ public function __construct(Memcache $cache)
      */
     protected function fetchObjectFromCache($key)
     {
-        if (false === $result = unserialize($this->cache->get($key))) {
+        if (false === $result = parent::unserialize($this->cache->get($key))) {
             return [false, null, [], null];
         }
 

src/Adapter/Memcache/Tests/IntegrationPoolTest.php

@@ -11,12 +11,15 @@
 
 namespace Cache\Adapter\Memcache\Tests;
 
+use Cache\Adapter\Common\Tests\Traits\TestNotUnserializableTrait;
 use Cache\Adapter\Memcache\MemcacheCachePool;
 use Cache\IntegrationTests\CachePoolTest;
 use Memcache;
 
 class IntegrationPoolTest extends CachePoolTest
 {
+    use TestNotUnserializableTrait;
+
     private $client;
 
     public function createCachePool()