0

Any Patch is available for below Issue i have not upgraded Security enhancements

In general, we’ve removed serialize/unserialize from most the code to improve protection against remote code execution attacks. We’ve enhanced protection of code where use of object serialization or unserialization was unavoidable. Additionally, we’ve increased our use of output escaping to protect against cross-site scripting (XSS) attacks.

So you need to inject \Magento\Framework\Serialize\Serializer\Json class for serialize and unserialize values.

use following code for serialize and unserialize values.

protected $serialize;

public function __construct(
    \Magento\Framework\Serialize\Serializer\Json $serialize
) {
    $this->serialize = $serialize;
}

public function serialize($value){
    return $this->serialize->serialize($value);
}

public function unserialize($value){
    return $this->serialize->unserialize($value);
}

1 Answer 1

0

You can also get this from .htaccess file?

# Extra Security Headers
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header always append X-Frame-Options SAMEORIGIN
    Header set X-Content-Type-Options nosniff
</IfModule>

Google it for an explanation.

1
  • i need patch file which is related to serialise/unserialise
    – Mark henry
    Jul 9, 2018 at 6:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.