ContentLengthKnownBodyMismatch

warning native on by default

Match Content-Length to the emitted bytes.

Example

Finding:

php

<?php
header("Content-Length: 2"); echo "hello"; exit;

Reported:

Track effective literal Content-Length set by builtin header. Report that header when a complete straight-line local response path emits a statically known sequence of echo/print literal bytes and terminates, with total byte length unequal to the declared decimal length. Replacements override prior headers. Include final top-level path or a function ending in exit; do not treat returning from a helper as response completion. exit and die terminate the path in every spelling: bare, with an empty argument list (exit(), die()), which emits nothing, or with a string argument of known length, whose bytes count as body.
Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias or unknown call involving the tracked value. When the proof is inconclusive, nothing is reported.

Unknown output, output buffering/handlers, zlib compression, includes, unknown calls, HEAD handling, 1xx/204/304 responses, transfer encoding and an exit/die argument of unknown length invalidate body-length proof. A configured SAPI transform cannot be assumed absent if evidence enables it.
Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

No automatic fix. Choosing a repair requires runtime information, error-handling policy or a semantic decision.

Available throughout PHP 5.3–8.5.

json

{
  "rules": {
    "ContentLengthKnownBodyMismatch": {
      "enabled": false
    }
  }
}

Before the statement or declaration (or the first statement of the file):

php

// @custos-ignore ContentLengthKnownBodyMismatch