N°9379 - PHP unserialze function - security hardening

- add unitary test

tests/php-unit-tests/unitary-tests/application/utilsTest.php

@@ -23,6 +23,7 @@
 namespace Combodo\iTop\Test\UnitTest\Application;
 
 use Combodo\iTop\Test\UnitTest\ItopTestCase;
+use CoreException;
 use ormDocument;
 use utils;
 
@@ -1043,4 +1044,21 @@ INI;
 
 		unlink($sTmpFileOutsideItop);
 	}
+
+	public function testUnserialize()
+	{
+		// data to unserialize containing an object
+		$sData = 'a:2:{s:6:"string";s:9:"My string";s:6:"object";O:8:"DateTime":3:{s:4:"date";s:26:"2026-04-13 09:09:23.033175";s:13:"timezone_type";i:3;s:8:"timezone";s:16:"Europe/Amsterdam";}}';
+
+		// allow the DateTime object (no exception triggered)
+		utils::Unserialize($sData, ['allowed_classes' => ['DateTime']]);
+
+		// flag to avoid throwing an exception
+		utils::Unserialize($sData, ['allowed_classes' => false], false);
+
+		// flag to require throwing an exception
+		$this->expectException(CoreException::class);
+		utils::Unserialize($sData);
+
+	}
 }