Merge pull request #58864 from nextcloud/fix/cached_exporter_hardening

Author: Altahrim

lib/private/OpenMetrics/Exporters/Cached.php

@@ -13,6 +13,8 @@
 use OCP\ICache;
 use OCP\ICacheFactory;
 use OCP\OpenMetrics\IMetricFamily;
+use OCP\OpenMetrics\Metric;
+use OCP\OpenMetrics\MetricValue;
 use Override;
 
 /**
@@ -43,7 +45,12 @@ abstract public function gatherMetrics(): Generator;
 	public function metrics(): Generator {
 		$cacheKey = static::class;
 		if ($data = $this->cache->get($cacheKey)) {
-			yield from unserialize($data);
+			yield from unserialize(
+				$data,
+				[
+					'allowed_classes' => [Metric::class, MetricValue::class],
+				],
+			);
 			return;
 		}