feat(serializers): use Symfony VarExporter for secure and fast var exporting.

Affected:
- PhpArray
- PhpCode

New setting added:
- wrap (boolean) - To set php return wrapper for result value.

composer.json

@@ -59,7 +59,8 @@
         "siriusphp/upload": "^3.0.1",
 
         "filp/whoops": "^2.14.3",
-        "symfony/console": "^5.3.7"
+        "symfony/console": "^5.3.7",
+        "symfony/var-exporter": "^5.3"
     },
     "suggest": {
         "ext-zend-opcache": "Recommended for better performance",
@@ -84,4 +85,4 @@
         "victorjonsson/markdowndocs": "^1.3.8",
         "kint-php/kint": "^3.3"
     }
-}
+}

src/flextype/core/Serializers/PhpArray.php

@@ -9,6 +9,8 @@ declare(strict_types=1);
 
 namespace Flextype\Serializers;
 
+use Symfony\Component\VarExporter\VarExporter;
+
 use RuntimeException;
 
 use function cache;
@@ -27,8 +29,14 @@ class PhpArray
      */
     public function encode($input): string
     {
+        $wrap = registry()->get('flextype.settings.serializers.phparray.encode.wrap');
+
         try {
-            $data = "<?php\n return " . var_export($input, true) . ";\n";
+            if ($wrap) {
+                $data = "<?php\n return " . VarExporter::export($input) . ";\n";
+            } else {
+                $data = VarExporter::export($input);
+            }
         } catch (Exception $e) {
             throw new RuntimeException('Encoding PhpArray failed');
         }

src/flextype/core/Serializers/PhpCode.php

@@ -9,6 +9,8 @@ declare(strict_types=1);
 
 namespace Flextype\Serializers;
 
+use Symfony\Component\VarExporter\VarExporter;
+
 use RuntimeException;
 
 use function cache;
@@ -31,8 +33,14 @@ class PhpCode
      */
     public function encode($input): string
     {
+        $wrap = registry()->get('flextype.settings.serializers.phpcode.encode.wrap');
+
         try {
-            $data = var_export($input, true);
+            if ($wrap) {
+                $data = "<?php\n return " . VarExporter::export($input) . ";\n";
+            } else {
+                $data = VarExporter::export($input);
+            }
         } catch (Exception $e) {
             throw new RuntimeException('Encoding PhpCode failed');
         }

src/flextype/settings.yaml

@@ -456,9 +456,13 @@ serializers:
   phparray:
     decode:
       cache: true
+    encode:
+      wrap: true
   phpcode:
     decode:
       cache: true
+    encode:
+      wrap: false
 
 # Parsers
 #