1--TEST-- 2Test unserialize() with Stringable object in allowed_classes 3--FILE-- 4<?php 5class foo { 6 public $x = "bar"; 7} 8$z = array(new foo(), 2, "3"); 9$s = serialize($z); 10 11class Name { 12 public function __toString(): string { 13 return 'Foo'; 14 } 15} 16 17$o = new Name(); 18 19var_dump(unserialize($s, ["allowed_classes" => [$o]])); 20?> 21--EXPECT-- 22array(3) { 23 [0]=> 24 object(foo)#3 (1) { 25 ["x"]=> 26 string(3) "bar" 27 } 28 [1]=> 29 int(2) 30 [2]=> 31 string(1) "3" 32} 33