naholyr/js-php-unserialize

JavaScript tool to unserialize data taken from PHP. It can parse "serialize()" output, or even serialized sessions data.

js-php-unserialize

JavaScript tool to unserialize data taken from PHP. It can parse "serialize()" output, or even serialized sessions data.

Credits

• The PHP unserializer is taken from kvz's phpjs project.
• The session unserializer's idea is taken from dumpling, which is highly limited by its lack of a real unserializer, and has lot of crash cases.

Installation

Node.js

Install from npm :

npm install php-unserialize

The use it the usual way :

var PHPUnserialize = require('php-unserialize');

console.log(PHPUnserialize.unserialize('a:0:{}')); // {}

Browser

Download tarball from github and then unarchive this where you want, then you can simply include it in your page :

<script src="/path/to/php-unserialize.js"></script>
<script>
  console.log(PHPUnserialize.unserialize('a:0:{}')); // {}
</script>

Compatibility issues

This library has been tested server-side only. For example it uses [].reduce, so it may not work on some browsers. Do not hesitate to make pull requests to fix it for you favorite browsers :)

Notes

• Note that array() will be converted to {} and not []. That can be discussed as array() in PHP has various significations. A choice had to be done, but it may change in the future (cf. next point).
• A less obvious conversion is array('a', 'b') which will be converted to {"0": "a", "1": "b"}. Quite annoying, and it will be fixed if necessary (this means I won't work on this issue unless you really need it, but I agree this is not normal behavior).

Usage

The module exposes two methods:

unserialize(string)

Unserialize output taken from PHP's serialize() method.

It currently does not suport objects.

unserializeSession(string)

Unserialize PHP serialized session. PHP uses a weird custom format to serialize session data, something like "$key1$serializedData1|$key2$serializedData2|…", this methods will parse this and unserialize chunks so you can have a simple anonymous objects.

js-php-unserialize's Issues

No Licence

Very useful plugin, however it can't be used in any commercial software since you don't have any sort of licencing listed.

Add functionality to deserialize objects?

SyntaxError: Unknown / Unhandled data type(s): o

example:

O:10:"ImportForm"

Php unserialize error : Unknown / Unhandled data type(s):;

Hello and thank you for you helpful module,
im trying to using it in my api but i have probleme with some serialized array;

a:7:{s:13:"varPertinence";a:7:{i:0;s:8:"CLINIQUE";i:1;s:1:"7";i:2;s:1:"8";i:3;s:1:"9";i:4;s:2:"10";i:5;s:2:"11";i:6;s:2:"12";}s:10:"varSegment";N;s:12:"varSSegment1";N;s:12:"varSSegment2";N;s:7:"varVoie";N;s:4:"ingr";s:15:"levure de bière";s:2:"mc";N;}

with this one i got error :

SyntaxError: Unknown / Unhandled data type(s): ;

could you explain me please what mean this error and how to solve it if is there a solution? thank you so much

Special characters don't get unserialized correctly

The problem is simple: unserializeSession splits input into parts using regexps, therefore, if some string data contains |, unserializeSession may fail to parse data.
I also got an infinite loop in some cases (cannot get minimal example).

Unknown / Unhandled data types(s): u

using unserialize():

SyntaxError: Unknown / Unhandled data type(s): u
    at error (/usr/share/nginx5/realtime/node_modules/php-unserialize/php-unserialize.js:54:13)
    at _unserialize (/usr/share/nginx5/realtime/node_modules/php-unserialize/php-unserialize.js:166:11)
    at Object.unserialize (/usr/share/nginx5/realtime/node_modules/php-unserialize/php-unserialize.js:173:10)

using unserializeSession:

/usr/share/nginx5/realtime/node_modules/php-unserialize/php-unserialize.js:201
        throw new Error('Parse error on part "' + part + '"');
        ^

Error: Parse error on part "O:21:"App\Model\User"

whats the fucking point if it can't even unserialize an object?

Add support for serialize :)

I know this probably will be its own thing, but I'd love to see support for serialize as well an unserialize !

existance of objects block deserializing the whole string

Seems like it would be more logical to return this:

{
    data1: "...",
    data2: "...",
    data3: "...",
    unexpectedObject:"[Object PHPClass]",
}

instead of throwing an exception and blocking access to the other serialized data.

Unserializing large strings

I have a 60kb serialized string from PHP. I cannot unserialize it. The last three characters are not appended ", }, and ]. For smaller string it returns correct unserialized data. Is there any way to solve this problem?

array() should be converted to [] and not to {}.

This conversion behaviour is really needed when unserializing the data saved into Redis by Drupal.