Language: deny SensitiveParameterValue serialize/unserialize like Zend (#23086)

ext/standard/VmSerialize.php

@@ -170,6 +170,10 @@ public static function unserializePayload(Context $ctx, string $payload, ?array
             if (0 === strcasecmp($className, 'WeakReference')) {
                 throw new \Exception("Unserialization of 'WeakReference' is not allowed");
             }
+            // php-src Zend/zend_exceptions.c — @not-serializable SensitiveParameterValue (#23086).
+            if (0 === strcasecmp($className, 'SensitiveParameterValue')) {
+                throw new \Exception("Unserialization of 'SensitiveParameterValue' is not allowed");
+            }
             // php-src ext/curl/curl_file.stub.php — @not-serializable (#23064).
             CurlFileSerializeDeny::rejectUnserialization($className);
             // php-src ext/fileinfo/fileinfo.stub.php — @not-serializable (#23093).
@@ -521,6 +525,10 @@ private static function encodeWireObject(
         if (0 === strcasecmp($entry->class->name, 'WeakReference')) {
             throw new \Exception("Serialization of 'WeakReference' is not allowed");
         }
+        // php-src Zend/zend_exceptions.c — @not-serializable SensitiveParameterValue (#23086).
+        if (0 === strcasecmp($entry->class->name, 'SensitiveParameterValue')) {
+            throw new \Exception("Serialization of 'SensitiveParameterValue' is not allowed");
+        }
         // php-src ext/curl/curl_file.stub.php — @not-serializable (#23064).
         CurlFileSerializeDeny::rejectSerialization($entry->class->name);
         // php-src ext/fileinfo/fileinfo.stub.php — @not-serializable (#23093).
@@ -922,6 +930,10 @@ private static function exportForSerialize(Context $ctx, Variable $value): mixed
             && 0 === strcasecmp($value->toObject()->class->name, 'WeakReference')) {
             throw new \Exception("Serialization of 'WeakReference' is not allowed");
         }
+        if (Variable::TYPE_OBJECT === $value->type
+            && 0 === strcasecmp($value->toObject()->class->name, 'SensitiveParameterValue')) {
+            throw new \Exception("Serialization of 'SensitiveParameterValue' is not allowed");
+        }
         if (Variable::TYPE_OBJECT === $value->type) {
             CurlFileSerializeDeny::rejectSerialization($value->toObject()->class->name);
             FinfoSerializeDeny::rejectSerialization($value->toObject()->class->name);

test/compliance/cases/language/sensitive_parameter_value_serialize_disallowed.phpt

@@ -0,0 +1,32 @@
+--TEST--
+language SensitiveParameterValue serialize()/unserialize() reject (issue #23086, Zend/zend_exceptions.c)
+--FILE--
+<?php
+$s = new SensitiveParameterValue('secret');
+try {
+    $payload = serialize($s);
+    echo "serialize:no-throw:", $payload, "\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+    if (false !== strpos($e->getMessage(), 'secret')) {
+        echo "leak:message-contains-secret\n";
+    }
+}
+
+try {
+    unserialize('O:23:"SensitiveParameterValue":0:{}');
+    echo "unserialize:no-throw\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+}
+
+try {
+    unserialize('O:23:"SensitiveParameterValue":1:{s:5:"value";s:6:"secret";}');
+    echo "unserialize-leak:no-throw\n";
+} catch (Throwable $e) {
+    echo 'leak:', get_class($e), ':', $e->getMessage(), "\n";
+}
+--EXPECT--
+Exception:Serialization of 'SensitiveParameterValue' is not allowed
+Exception:Unserialization of 'SensitiveParameterValue' is not allowed
+leak:Exception:Unserialization of 'SensitiveParameterValue' is not allowed

test/repro/issue_23086_sensitive_serialize_deny.php

@@ -0,0 +1,20 @@
+<?php
+// Repro #23086 — Zend refuses serialize()/unserialize() of SensitiveParameterValue.
+$s = new SensitiveParameterValue('secret');
+try {
+    echo serialize($s), "\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+}
+try {
+    unserialize('O:23:"SensitiveParameterValue":1:{s:5:"value";s:6:"secret";}');
+    echo "unserialize:ok\n";
+} catch (Throwable $e) {
+    echo get_class($e), ':', $e->getMessage(), "\n";
+}
+try {
+    unserialize('O:23:"SensitiveParameterValue":1:{s:30:"'."\0".'SensitiveParameterValue'."\0".'value";s:6:"secret";}');
+    echo "unserialize-leak:ok\n";
+} catch (Throwable $e) {
+    echo 'leak:', get_class($e), ':', $e->getMessage(), "\n";
+}