[php-src] Issue #22059: Unserializing enums despite `allowed_classes => false`
[email protected] (edorian)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/22059
Author: edorian
### Description
Hi,
I'm looking for some guidance on weither this is a bug or a documentation issue.
Should `unserialize($string, ['allowed_classes' => false]);` allow the deserialization of an enum?
Given that the docs at https://www.php.net/manual/en/language.types.enumerations.php explain Enums as a layer on top of classes the intended behavior maybe at least somewhat debatable:
> Enumerations are a restricting layer on top of classes and class constants
I'd be happy with either behavior, assuming there are no potential considerations around unserializing enums.
Either documenting or restricting this would be nice for clarity (Which I'm happy to do the docs PR for and close this issue).
---
The following code:
```php
<?php
enum TestEnum: string {
case Foo = 'foo';
}
$serialized = serialize(TestEnum::Foo); // E:12:\"TestEnum:Foo\";
$result = unserialize(
$serialized,
['allowed_classes' => false]
);
// enum(TestEnum::Foo)
var_dump($result);
```
Resulted in this output:
```
// enum(TestEnum::Foo)
```
But I expected this output instead:
```
// Either this is fine and the docs need updating
// Or it isn't and there should be an error
```
### PHP Version
```plain
PHP 8.6.0-dev (cli) (built: May 15 2026 16:51:39) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
```
### Operating System
_No response_