Deprecated CommandInterface::deserializeCommand() (CVE GHSA-w6f5-v2h6-g786) (#1724)

CHANGELOG.md

@@ -1,8 +1,9 @@
 ## Changelog
 
-## Unlreleads
+## Unreleased
 ### Added
 ### Changed
+- Deprecated `CommandInterface::deserializeCommand()` (CVE GHSA-w6f5-v2h6-g786)
 ### Fixed
 - Fixed RESP3 double parsing returning positive `INF` for `-inf` payloads (#1716)
 - Fixed `client_info` connection parameter being ignored (#1722)

src/Command/Command.php

@@ -158,6 +158,9 @@ abstract class Command implements CommandInterface
 
     /**
      * {@inheritDoc}
+     *
+     * @deprecated Not binary-safe; see CommandInterface::deserializeCommand().
+     *             Scheduled for removal in the next major.
      */
     public static function deserializeCommand(string $serializedCommand): CommandInterface
     {

src/Command/CommandInterface.php

@@ -98,6 +98,12 @@ interface CommandInterface
      *
      * @param  string $serializedCommand
      * @return static
+     *
+     * @deprecated Not binary-safe: it re-parses on "\r\n" and ignores RESP bulk-length
+     *             prefixes, so any argument containing "\r\n" is corrupted, and it
+     *             instantiates a command class from the parsed input. Never call it on
+     *             untrusted or serialized data (see CVE GHSA-w6f5-v2h6-g786). Scheduled
+     *             for removal in the next major.
      */
     public static function deserializeCommand(string $serializedCommand): CommandInterface;
 }

src/Command/RawCommand.php

@@ -153,6 +153,12 @@ final class RawCommand implements CommandInterface
         return $buffer;
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * @deprecated Not binary-safe; see CommandInterface::deserializeCommand().
+     *             Scheduled for removal in the next major.
+     */
     public static function deserializeCommand(string $serializedCommand): CommandInterface
     {
         if ($serializedCommand[0] !== '*') {