AmbiguousReplacementBackreference

warning native off by default quick-fix

Group: Probable bugs

Detect preg_replace with a literal replacement containing a numeric backreference followed immediately by a digit where the parsed larger capture number does not exist but the shorter one does.

Example

Before

<?php
$result=preg_replace('/(r)/','$11','r');

After fix

<?php
$result=preg_replace('/(r)/','${1}1','r');

Reported:

• line 2: Brace the replacement backreference before a literal digit.

Detection

• Report preg_replace with a literal replacement containing a numeric backreference followed immediately by a digit where the parsed larger capture number does not exist but the shorter one does.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is disabled; enable only when the stated intent matches the application.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases or recursion cannot establish definite facts. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Existing braced reference, actual larger capture groups, escaped dollar signs and unknown patterns are excluded.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

Rewrite every ambiguous reference in the replacement in one edit, bracing its shorter existing capture number. For example, when only capture 1 exists, $11 and $12 becomes ${1}1 and ${1}2. Preserve the literal quote style, binary-string prefix, surrounding bytes and existing escaping. In double-quoted strings, escape a previously unescaped dollar when introducing braces to prevent PHP interpolation.

Only fix ordinary single- or double-quoted literals when decoding the proposed raw edit proves the exact intended replacement value. References assembled through hexadecimal, octal or Unicode escapes, heredoc/nowdoc values, computed replacement expressions and any unproven raw-to-decoded correspondence remain report-only.

A fix is offered only when the concrete prerequisites above are proven. Edits use exact source byte ranges, preserve comments and argument evaluation order, and introduce syntax supported by the configured PHP version. Never invent error-handling policy.

PHP versions

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "AmbiguousReplacementBackreference": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore AmbiguousReplacementBackreference