ContentEncodingBodyMismatch

warning native on by default

Group: Probable bugs

Encode the body using the declared content coding.

Example

Finding:

<?php
header("Content-Encoding: gzip"); echo gzcompress("payload"); exit;

Reported:

• line 2: Encode the body using the declared content coding.

Detection

• Track an effective literal Content-Encoding gzip, deflate or identity and an emitted body proven produced directly by gzencode, gzcompress or gzdeflate. Report the emitted compression call when its format contradicts the declared coding: gzip requires gzip framing; HTTP deflate requires zlib framing. Identity contradicts any of these proven compressed outputs.
• The framing of the emitted body is the function's default (gzencode: gzip, gzcompress: zlib, gzdeflate: raw deflate) unless the call passes the third encoding argument, positionally or by name. That argument overrides the default for all three functions alike: ZLIB_ENCODING_GZIP (31) selects gzip framing, ZLIB_ENCODING_DEFLATE (15) zlib framing and ZLIB_ENCODING_RAW (-15) raw deflate. So gzdeflate($body, 9, ZLIB_ENCODING_GZIP) is a valid gzip body, and gzencode($body, -1, ZLIB_ENCODING_RAW) is not.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias or unknown call involving the tracked value. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Unknown body provenance, buffering/transformation, compound coding lists and subsequent replacement headers invalidate proof. Do not claim all plain strings are uncompressed binary data.
• An encoding argument that is not a statically known integer, or is a value other than the three framing constants, leaves the framing unproven: no report.
• An unpacked argument (...$options) may supply encoding; the framing is then unproven: no report.
• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

Fix

No automatic fix. Choosing a repair requires runtime information, error-handling policy or a semantic decision.

PHP versions

Available throughout PHP 5.3–8.5.

Configure

In custos.json:

{
  "rules": {
    "ContentEncodingBodyMismatch": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore ContentEncodingBodyMismatch