ArraySliceDiscardsRequiredKeys

warning native off by default

Group: Probable bugs

Array slicing normally renumbers numeric keys. Preserve keys when later code reads the original numeric positions. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
$p=array_slice([100=>"a",200=>"b"],0,1); echo $p[100];

Reported:

• line 2: Preserve numeric keys before reading the original key.

Detection

• Resolved array_slice has absent/false preserve_keys, a literal array with an explicitly written nonzero integer key in the retained slice, and a subsequent result access uses that original key that is absent after reindexing.
• The initial supported downstream proof is a single immediately following echo of the absent original numeric key. Input array keys must all be explicit known integers.
• All literal numeric input keys must be known and unique after PHP key normalization. Duplicate or unknown keys are excluded: overwriting can change the effective length and selected slice positions, so original literal item positions cannot establish the retained-key proof.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "ArraySliceDiscardsRequiredKeys": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore ArraySliceDiscardsRequiredKeys