Objective
#2190723: Add a KeyValueStore\FileStorage to replace e.g. ConfigStorage discovered that all key/value store implementations in core are hard-coding PHP
serialize()
as serialization format right now.PHP
serialize()
is definitely not always the most appropriate serialization format.unserialize()
has security issues.A key/value store MUST NOT care for the serialization format being used to begin with — its sole responsibility is to store a (string) value and retrieve it. The serialization format only needs to be consistent for each instance of a key/value store.
As a concrete use-case, the file-based configuration system expects data to be encoded and decoded in YAML.
Proposed solution
Establish
Drupal\Core\Serialization
as a core component that provides default implementations for serialization formats used in Drupal.Inject a serialization format into each key/value store instance.
Notes
This issue only adds the
PhpSerialize
serialization format, which is currently used by key/value store implementations.The set of formats is completed by
#2208609: Move Json utility class into Drupal\Core\Serialization
#2208633: Add a Yaml class to Drupal\Core\Serialization