本文目录导读：
我来详细解释PHP反序列化漏洞和签名验证的相关概念：
PHP序列化与反序列化基础
序列化
<?php
class User {
public $username;
public $isAdmin = false;
function __construct($name) {
$this->username = $name;
}
}
$user = new User("test");
echo serialize($user);
// 输出: O:4:"User":2:{s:8:"username";s:4:"test";s:7:"isAdmin";b:0;}
?>
反序列化
<?php
$data = 'O:4:"User":2:{s:8:"username";s:4:"test";s:7:"isAdmin";b:1;}';
$user = unserialize($data);
// 可能产生安全风险
?>
签名机制防止反序列化攻击
安全的签名实现
<?php
class SecureData {
private $secretKey;
public function __construct($key) {
$this->secretKey = $key;
}
// 签名数据
public function signData($data) {
$serialized = serialize($data);
$signature = hash_hmac('sha256', $serialized, $this->secretKey);
return base64_encode($serialized) . '.' . $signature;
}
// 验证并反序列化
public function verifyAndUnserialize($signedData) {
$parts = explode('.', $signedData);
if (count($parts) !== 2) {
throw new Exception("Invalid format");
}
$data = base64_decode($parts[0]);
$signature = $parts[1];
// 验证签名
$expectedSignature = hash_hmac('sha256', $data, $this->secretKey);
if (!hash_equals($expectedSignature, $signature)) {
throw new Exception("Signature verification failed");
}
return unserialize($data);
}
}
// 使用示例
$secure = new SecureData("your-secret-key-here");
// 安全地序列化数据
$signedData = $secure->signData(['user' => 'admin', 'role' => 'user']);
echo "Signed data: " . $signedData . "\n";
// 安全地反序列化数据
try {
$result = $secure->verifyAndUnserialize($signedData);
print_r($result);
} catch (Exception $e) {
echo "Error: " . $e->getMessage();
}
?>
常见的签名反序列化攻击场景
不安全的实现示例
<?php
// 不安全的实现 - 容易被绕过
class UnsafeClass {
public $data;
public function processData($input) {
// 直接反序列化用户输入，没有签名验证
$obj = unserialize(base64_decode($input));
return $obj;
}
}
// 攻击者可以构造恶意数据
$maliciousData = base64_encode('O:12:"MaliciousClass":0:{}');
$unsafe = new UnsafeClass();
$result = $unsafe->processData($maliciousData);
?>
安全的签名验证实践
完整的签名验证类
<?php
class SecureSerializer {
private $key;
private $cipher = 'aes-256-gcm';
public function __construct($key) {
$this->key = $key;
}
// 加密并签名数据
public function secureSerialize($data) {
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length($this->cipher));
$tag = '';
$encrypted = openssl_encrypt(
serialize($data),
$this->cipher,
$this->key,
OPENSSL_RAW_DATA,
$iv,
$tag
);
// 组合加密数据
$payload = base64_encode($iv . $tag . $encrypted);
// 添加签名
$signature = hash_hmac('sha256', $payload, $this->key);
return $payload . '.' . $signature;
}
// 验证并解密数据
public function secureUnserialize($signedData) {
$parts = explode('.', $signedData);
if (count($parts) !== 2) {
throw new Exception("Invalid format");
}
$payload = $parts[0];
$signature = $parts[1];
// 验证签名
$expectedSignature = hash_hmac('sha256', $payload, $this->key);
if (!hash_equals($expectedSignature, $signature)) {
throw new Exception("Invalid signature");
}
// 解密数据
$decoded = base64_decode($payload);
$ivLen = openssl_cipher_iv_length($this->cipher);
$iv = substr($decoded, 0, $ivLen);
$tag = substr($decoded, $ivLen, 16);
$encrypted = substr($decoded, $ivLen + 16);
$decrypted = openssl_decrypt(
$encrypted,
$this->cipher,
$this->key,
OPENSSL_RAW_DATA,
$iv,
$tag
);
if ($decrypted === false) {
throw new Exception("Decryption failed");
}
return unserialize($decrypted);
}
}
// 使用示例
$serializer = new SecureSerializer("your-256-bit-secret-key");
$data = ['user_id' => 123, 'role' => 'user'];
// 安全序列化
$secureData = $serializer->secureSerialize($data);
echo "Secure data: " . $secureData . "\n";
// 安全反序列化
try {
$result = $serializer->secureUnserialize($secureData);
print_r($result);
} catch (Exception $e) {
echo "Error: " . $e->getMessage();
}
?>
防御最佳实践
<?php
// 1. 使用白名单验证类
class SafeUnserializer {
private $allowedClasses = ['User', 'Product', 'Order'];
public function safeUnserialize($data) {
return unserialize($data, ['allowed_classes' => $this->allowedClasses]);
}
}
// 2. JSON替代序列化
class JsonSafe {
public static function encode($data) {
return json_encode($data);
}
public static function decode($data) {
return json_decode($data, true);
}
}
// 3. 验证和清理输入
class InputValidator {
public static function validateSerializedData($data) {
// 检查是否包含危险魔法方法
$dangerousMethods = ['__destruct', '__wakeup', '__call', '__callStatic',
'__get', '__set', '__isset', '__unset', '__sleep',
'__toString', '__invoke'];
foreach ($dangerousMethods as $method) {
if (strpos($data, $method) !== false) {
throw new Exception("Dangerous method detected: $method");
}
}
return true;
}
}
// 综合使用
$safeUnser = new SafeUnserializer();
$data = 'O:4:"User":1:{s:8:"username";s:4:"test";}';
try {
// 验证输入
InputValidator::validateSerializedData($data);
// 安全反序列化
$result = $safeUnser->safeUnserialize($data);
print_r($result);
} catch (Exception $e) {
echo "Security error: " . $e->getMessage();
}
?>
重要安全建议
- 永远不要信任用户输入的序列化数据
- 使用签名验证数据完整性
- 限制反序列化的类
- 考虑使用JSON替代序列化
- 实施加密保护敏感数据
- 使用最新的PHP版本和库
签名反序列化的关键是：
- 创建签名时使用密钥
- 反序列化前验证签名
- 使用
hash_equals()防止时序攻击 - 加密敏感数据
- 限制允许反序列化的类
这样即使攻击者获得了序列化数据,如果没有正确的签名也无法成功利用反序列化漏洞。
