CurlCustomGetRetainsPostBody

warning native off by default

Group: Probable bugs

A custom GET method does not clear an already configured request body. Remove the body when switching to a bodyless GET request. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
$h=curl_init();curl_setopt($h,CURLOPT_POSTFIELDS,"x=1");curl_setopt($h,CURLOPT_CUSTOMREQUEST,"GET");curl_exec($h);
$g=curl_init();curl_setopt($g,CURLOPT_POSTFIELDS,["x"=>1]);curl_setopt($g,CURLOPT_CUSTOMREQUEST,"GET");curl_exec($g);

Reported:

• line 2: Clear the request body before switching to GET.
• line 3: Clear the request body before switching to GET.

Detection

• Same curl handle configures nonempty CURLOPT_POSTFIELDS followed by CURLOPT_CUSTOMREQUEST GET and executes without clearing body. Require straight-line final state; report opt-in because GET bodies can be intentional.
• Exclude later CURLOPT_HTTPGET, CURLOPT_POST, CURLOPT_UPLOAD or CURLOPT_NOBODY setters between the body/custom-GET setup and execution; they can change the underlying transfer mode and invalidate the retained-body proof.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "CurlCustomGetRetainsPostBody": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore CurlCustomGetRetainsPostBody