Stdlib: deny CurlHandle/Multi/Share serialize like Zend (#23074)

ext/curl/CurlFileSerializeDeny.php

@@ -5,10 +5,21 @@
 namespace PHPCompiler\ext\curl;
 
 /**
- * php-src ext/curl/curl_file.stub.php — @not-serializable on CURLFile (#23064).
+ * php-src @not-serializable curl objects:
+ * - CURLFile — ext/curl/curl_file.stub.php (#23064)
+ * - CurlHandle / CurlMultiHandle / CurlShareHandle — ext/curl/curl.stub.php (#23074)
  */
 final class CurlFileSerializeDeny
 {
+    /** @var list<string> */
+    private const DENIED_LC = [
+        CurlFileBuiltin::CLASS_LC,
+        VmCurlEasy::CLASS_LC,
+        VmCurlMulti::CLASS_LC,
+        VmCurlShare::CLASS_LC,
+        VmCurlShare::PERSISTENT_CLASS_LC,
+    ];
+
     public static function rejectSerialization(string $className): void
     {
         if (self::isDenied($className)) {
@@ -25,7 +36,7 @@ public static function rejectUnserialization(string $className): void
 
     private static function isDenied(string $className): bool
     {
-        return CurlFileBuiltin::CLASS_LC === strtolower(ltrim($className, '\\'));
+        return \in_array(strtolower(ltrim($className, '\\')), self::DENIED_LC, true);
     }
 
     private static function displayName(string $className): string

test/compliance/cases/stdlib/curl_handle_serialize_disallowed.phpt

@@ -0,0 +1,21 @@
+--TEST--
+stdlib CurlHandle serialize()/unserialize() reject (issue #23074, ext/curl/curl.stub.php)
+--FILE--
+<?php
+$ch = curl_init();
+try {
+    serialize($ch);
+    echo "serialize:no-throw\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+}
+
+try {
+    unserialize('O:10:"CurlHandle":0:{}');
+    echo "unserialize:no-throw\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+}
+--EXPECT--
+Exception:Serialization of 'CurlHandle' is not allowed
+Exception:Unserialization of 'CurlHandle' is not allowed

test/compliance/cases/stdlib/curl_multi_share_serialize_disallowed.phpt

@@ -0,0 +1,20 @@
+--TEST--
+stdlib CurlMultiHandle/CurlShareHandle serialize() reject (issue #23074 sibling)
+--FILE--
+<?php
+try {
+    serialize(curl_multi_init());
+    echo "multi:no-throw\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+}
+
+try {
+    serialize(curl_share_init());
+    echo "share:no-throw\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+}
+--EXPECT--
+Exception:Serialization of 'CurlMultiHandle' is not allowed
+Exception:Serialization of 'CurlShareHandle' is not allowed

test/repro/issue_23074_curlhandle_serialize_deny.php

@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+
+$ch = curl_init();
+try {
+    echo serialize($ch), "\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+}
+
+try {
+    unserialize('O:10:"CurlHandle":0:{}');
+    echo "unserialize:no-throw\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+}