PHP 怎么PHP 签名反序列化

wen PHP项目 2026-07-30 166

本文目录导读：

PHP 怎么PHP 签名反序列化

PHP序列化与反序列化基础
签名机制防止反序列化攻击
常见的签名反序列化攻击场景
安全的签名验证实践
防御最佳实践
重要安全建议

我来详细解释PHP反序列化漏洞和签名验证的相关概念：

PHP序列化与反序列化基础

序列化

<?php
class User {
    public $username;
    public $isAdmin = false;
    function __construct($name) {
        $this->username = $name;
    }
}
$user = new User("test");
echo serialize($user);
// 输出: O:4:"User":2:{s:8:"username";s:4:"test";s:7:"isAdmin";b:0;}
?>

反序列化

<?php
$data = 'O:4:"User":2:{s:8:"username";s:4:"test";s:7:"isAdmin";b:1;}';
$user = unserialize($data);
// 可能产生安全风险
?>

签名机制防止反序列化攻击

安全的签名实现

<?php
class SecureData {
    private $secretKey;
    public function __construct($key) {
        $this->secretKey = $key;
    }
    // 签名数据
    public function signData($data) {
        $serialized = serialize($data);
        $signature = hash_hmac('sha256', $serialized, $this->secretKey);
        return base64_encode($serialized) . '.' . $signature;
    }
    // 验证并反序列化
    public function verifyAndUnserialize($signedData) {
        $parts = explode('.', $signedData);
        if (count($parts) !== 2) {
            throw new Exception("Invalid format");
        }
        $data = base64_decode($parts[0]);
        $signature = $parts[1];
        // 验证签名
        $expectedSignature = hash_hmac('sha256', $data, $this->secretKey);
        if (!hash_equals($expectedSignature, $signature)) {
            throw new Exception("Signature verification failed");
        }
        return unserialize($data);
    }
}
// 使用示例
$secure = new SecureData("your-secret-key-here");
// 安全地序列化数据
$signedData = $secure->signData(['user' => 'admin', 'role' => 'user']);
echo "Signed data: " . $signedData . "\n";
// 安全地反序列化数据
try {
    $result = $secure->verifyAndUnserialize($signedData);
    print_r($result);
} catch (Exception $e) {
    echo "Error: " . $e->getMessage();
}
?>

常见的签名反序列化攻击场景

不安全的实现示例

<?php
// 不安全的实现 - 容易被绕过
class UnsafeClass {
    public $data;
    public function processData($input) {
        // 直接反序列化用户输入，没有签名验证
        $obj = unserialize(base64_decode($input));
        return $obj;
    }
}
// 攻击者可以构造恶意数据
$maliciousData = base64_encode('O:12:"MaliciousClass":0:{}');
$unsafe = new UnsafeClass();
$result = $unsafe->processData($maliciousData);
?>

安全的签名验证实践

完整的签名验证类

<?php
class SecureSerializer {
    private $key;
    private $cipher = 'aes-256-gcm';
    public function __construct($key) {
        $this->key = $key;
    }
    // 加密并签名数据
    public function secureSerialize($data) {
        $iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length($this->cipher));
        $tag = '';
        $encrypted = openssl_encrypt(
            serialize($data),
            $this->cipher,
            $this->key,
            OPENSSL_RAW_DATA,
            $iv,
            $tag
        );
        // 组合加密数据
        $payload = base64_encode($iv . $tag . $encrypted);
        // 添加签名
        $signature = hash_hmac('sha256', $payload, $this->key);
        return $payload . '.' . $signature;
    }
    // 验证并解密数据
    public function secureUnserialize($signedData) {
        $parts = explode('.', $signedData);
        if (count($parts) !== 2) {
            throw new Exception("Invalid format");
        }
        $payload = $parts[0];
        $signature = $parts[1];
        // 验证签名
        $expectedSignature = hash_hmac('sha256', $payload, $this->key);
        if (!hash_equals($expectedSignature, $signature)) {
            throw new Exception("Invalid signature");
        }
        // 解密数据
        $decoded = base64_decode($payload);
        $ivLen = openssl_cipher_iv_length($this->cipher);
        $iv = substr($decoded, 0, $ivLen);
        $tag = substr($decoded, $ivLen, 16);
        $encrypted = substr($decoded, $ivLen + 16);
        $decrypted = openssl_decrypt(
            $encrypted,
            $this->cipher,
            $this->key,
            OPENSSL_RAW_DATA,
            $iv,
            $tag
        );
        if ($decrypted === false) {
            throw new Exception("Decryption failed");
        }
        return unserialize($decrypted);
    }
}
// 使用示例
$serializer = new SecureSerializer("your-256-bit-secret-key");
$data = ['user_id' => 123, 'role' => 'user'];
// 安全序列化
$secureData = $serializer->secureSerialize($data);
echo "Secure data: " . $secureData . "\n";
// 安全反序列化
try {
    $result = $serializer->secureUnserialize($secureData);
    print_r($result);
} catch (Exception $e) {
    echo "Error: " . $e->getMessage();
}
?>

防御最佳实践

<?php
// 1. 使用白名单验证类
class SafeUnserializer {
    private $allowedClasses = ['User', 'Product', 'Order'];
    public function safeUnserialize($data) {
        return unserialize($data, ['allowed_classes' => $this->allowedClasses]);
    }
}
// 2. JSON替代序列化
class JsonSafe {
    public static function encode($data) {
        return json_encode($data);
    }
    public static function decode($data) {
        return json_decode($data, true);
    }
}
// 3. 验证和清理输入
class InputValidator {
    public static function validateSerializedData($data) {
        // 检查是否包含危险魔法方法
        $dangerousMethods = ['__destruct', '__wakeup', '__call', '__callStatic', 
                             '__get', '__set', '__isset', '__unset', '__sleep', 
                             '__toString', '__invoke'];
        foreach ($dangerousMethods as $method) {
            if (strpos($data, $method) !== false) {
                throw new Exception("Dangerous method detected: $method");
            }
        }
        return true;
    }
}
// 综合使用
$safeUnser = new SafeUnserializer();
$data = 'O:4:"User":1:{s:8:"username";s:4:"test";}';
try {
    // 验证输入
    InputValidator::validateSerializedData($data);
    // 安全反序列化
    $result = $safeUnser->safeUnserialize($data);
    print_r($result);
} catch (Exception $e) {
    echo "Security error: " . $e->getMessage();
}
?>