CsvBlankRecordShapeMismatch

warning native on by default

Group: Probable bugs

Recognize a blank CSV record as a null field.

Example

Finding:

<?php
$fp = fopen("php://memory", "r+"); fwrite($fp, "
"); rewind($fp); if (fgetcsv($fp) === []) {}

Reported:

• line 3: Recognize a blank CSV record as a null field.

Detection

• Track a fgetcsv or SplFileObject::fgetcsv result; report strict equality/inequality against an empty array when a blank record is proven from a local in-memory stream containing a single newline (LF or CRLF), at position zero. For an unknown stream, do not infer blank-record intent from the comparison alone.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias or unknown call involving the tracked value. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Empty arrays produced by application filtering, unknown stream data and checks against [null] are excluded.
• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

Fix

No automatic fix. Choosing a repair requires runtime information, error-handling policy or a semantic decision.

PHP versions

Available throughout PHP 5.3–8.5.

Configure

In custos.json:

{
  "rules": {
    "CsvBlankRecordShapeMismatch": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore CsvBlankRecordShapeMismatch