[6.x] Add serializable classes to allowlist (#14416)

Co-authored-by: Jason Varga <jason@pixelfear.com>

Author: duncanmcclean

src/Providers/AddonServiceProvider.php

@@ -717,6 +717,20 @@ public function registerExternalStylesheet(string $url)
         Statamic::externalStyle($url);
     }
 
+    protected function registerSerializableClasses(array $classes)
+    {
+        $existing = $this->app['config']->get('cache.serializable_classes');
+
+        if ($existing === true) {
+            return;
+        }
+
+        $this->app['config']->set('cache.serializable_classes', array_merge(
+            is_array($existing) ? $existing : [],
+            $classes
+        ));
+    }
+
     protected function schedule(Schedule $schedule)
     {
         //

src/Providers/AppServiceProvider.php

@@ -229,6 +229,45 @@ public function register()
                 ->finalNewline(config('statamic.templates.style.final_newline', false))
                 ->preferComponentSyntax(config('statamic.templates.antlers.use_components', false));
         });
+
+        $this->registerSerializableClasses();
+    }
+
+    private function registerSerializableClasses()
+    {
+        $existing = $this->app['config']->get('cache.serializable_classes');
+
+        if ($existing === true) {
+            return;
+        }
+
+        $classes = [
+            \Statamic\Auth\File\User::class,
+            \Statamic\Assets\Asset::class,
+            \Statamic\Assets\AssetContainer::class,
+            \Statamic\Entries\Collection::class,
+            \Statamic\Entries\Entry::class,
+            \Statamic\Forms\Form::class,
+            \Statamic\Forms\Submission::class,
+            \Statamic\Globals\GlobalSet::class,
+            \Statamic\Globals\Variables::class,
+            \Statamic\Revisions\Revision::class,
+            \Statamic\Structures\Nav::class,
+            \Statamic\Structures\NavTree::class,
+            \Statamic\Structures\CollectionTree::class,
+            \Statamic\Structures\CollectionStructure::class,
+            \Statamic\Taxonomies\Taxonomy::class,
+            \Statamic\Taxonomies\LocalizedTerm::class,
+            \Statamic\Taxonomies\Term::class,
+            \Carbon\Carbon::class,
+            \Illuminate\Support\Carbon::class,
+            \Illuminate\Support\Collection::class,
+        ];
+
+        $this->app['config']->set('cache.serializable_classes', array_merge(
+            is_array($existing) ? $existing : [],
+            $classes
+        ));
     }
 
     protected function registerMiddlewareGroup()

src/Providers/CacheServiceProvider.php

@@ -45,7 +45,12 @@ private function extendFileStore()
 
             Cache::extend('file', function ($app, $config) {
                 return Cache::repository(
-                    (new FileStore($app['files'], $config['path'], $config['permission'] ?? null))
+                    (new FileStore(
+                        $app['files'],
+                        $config['path'],
+                        $config['permission'] ?? null,
+                        $app['config']['cache.serializable_classes'] ?? null
+                    ))
                         ->setLockDirectory($config['lock_path'] ?? null),
                     $config
                 );

tests/Stache/BasicStoreTest.php

@@ -44,6 +44,7 @@ public function it_gets_an_item_by_key()
     public function items_are_different_instances_every_time()
     {
         config(['cache.default' => 'file']); // Doesn't work when they're arrays since the object is stored in memory.
+        config()->set('cache.serializable_classes', [TestBasicStoreItem::class]);
         \Illuminate\Support\Facades\Cache::clear();
 
         file_put_contents($this->tempDir.'/foo.yaml', '');