CsvDelimiterInvalidByteLength

error native on by default

Group: Probable bugs

Use a one-byte CSV separator.

Example

Finding:

<?php
fgetcsv($fp, 0, "::");

Reported:

• line 2: Use a one-byte CSV separator.

Detection

• For resolved fgetcsv, fputcsv, str_getcsv (PHP 5.3+) and SplFileObject CSV methods/setCsvControl, report an explicitly provided separator whose constant string length is not exactly one byte. Use byte length, not Unicode scalar length.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias or unknown call involving the tracked value. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Omitted default separator and unknown strings are excluded. A single-byte non-ASCII value is legal; UTF-8 multibyte separators are not.
• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

Fix

No automatic fix. Choosing a repair requires runtime information, error-handling policy or a semantic decision.

PHP versions

Available throughout PHP 5.3–8.5.

Configure

In custos.json:

{
  "rules": {
    "CsvDelimiterInvalidByteLength": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore CsvDelimiterInvalidByteLength