Dont allow unserializing classes with a destructor - 5.2

src/Symfony/Component/HttpClient/Response/CommonResponseTrait.php

@@ -127,6 +127,16 @@ trait CommonResponseTrait
         return $stream;
     }
 
+    public function __sleep()
+    {
+        throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
+    }
+
+    public function __wakeup()
+    {
+        throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
+    }
+
     /**
      * Closes the response and all its network handles.
      */

src/Symfony/Component/HttpClient/Response/TraceableResponse.php

@@ -44,6 +44,16 @@ class TraceableResponse implements ResponseInterface, StreamableInterface
         $this->event = $event;
     }
 
+    public function __sleep()
+    {
+        throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
+    }
+
+    public function __wakeup()
+    {
+        throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
+    }
+
     public function __destruct()
     {
         try {

src/Symfony/Component/RateLimiter/Policy/TokenBucket.php

@@ -104,6 +104,10 @@ final class TokenBucket implements LimiterStateInterface
      */
     public function __wakeup(): void
     {
+        if (!\is_string($this->stringRate)) {
+            throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
+        }
+
         $this->rate = Rate::fromString($this->stringRate);
         unset($this->stringRate);
     }