ArrayUniqueOnNonStringableObjects

warning native on by default

Group: Probable bugs

Default array_unique comparison needs string representations. Use an explicit identity or key when objects cannot be converted to strings.

Example

<?php
array_unique([new stdClass(),new stdClass()]);

Reported:

• line 2: Choose an explicit comparison for object deduplication.

Detection

• Resolved array_unique with default/SORT_STRING flag receives a literal array containing new stdClass or a resolved object class proven to lack __toString/Stringable. Do not infer missing methods from incomplete index.
• D1a. A class is proven non-stringable only when all of the following hold: neither it nor any ancestor declares __toString or implements Stringable; every parent class and used trait in its hierarchy resolves and the hierarchy is fully enumerated; and every PHP-provided class in the hierarchy (the class itself or an inherited one) belongs to the closed list of builtins verified to raise an error on string conversion: stdClass, ArrayObject, ArrayIterator, DateTime, DateTimeImmutable, DateTimeZone, DateInterval, SplObjectStorage, SplDoublyLinkedList, SplStack, SplQueue, SplFixedArray, SplPriorityQueue, SplMinHeap, SplMaxHeap, WeakMap. Engine and extension classes may convert to string through an internal handler without exposing a __toString method (GMP does), so a missing method proves nothing for any other PHP-provided class.
• Evaluate the effective array after PHP key normalization and duplicate-key overwrites, recursively where nested values supply evidence. Only surviving entries establish row collisions, nested arrays, non-stringable objects, formatted numeric strings or nested list shapes. Earlier entries overwritten by a later occurrence of the same normalized key are not evidence; unknown keys or unsupported effective-array evaluation discard proof.
• Require at least two surviving effective array entries. A singleton is returned unchanged without requiring comparison/string conversion and is excluded.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Do not report objects of a PHP-provided class outside the D1a list, or of a project class inheriting from one: array_unique([new GMP(5), new GMP(5)]) deduplicates without error. Do not report a class whose parent or trait cannot be resolved.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Effective array-key behavior follows the PHP array contract.

Configure

In custos.json:

{
  "rules": {
    "ArrayUniqueOnNonStringableObjects": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore ArrayUniqueOnNonStringableObjects