Harden InterventionBackend against abuse via PHP Object Injection

[mcdruid]

Description

I've discussed this with the Silverstripe Security Team before submitting a public PR.

There's a simple Gadget Chain which allows Arbitrary File Deletion in Silverstripe.

This is not directly exploitable by itself, but it's a tool an attacker could use if they find a way to pass unsafe input to unserialize() in a Silverstripe application.

As mentioned it's pretty simple. Here's an example payload:

O:39:"SilverStripe\Assets\InterventionBackend":1:{s:8:"tempPath";s:9:".htaccess";}

Additional context or points of discussion

No response

Validations

• You intend to implement the feature yourself
• You have read the contributing guide
• You strongly believe this feature should be in core, rather than being its own community module
• You have checked for existing issues or pull requests related to this feature (and didn't find any)