CurlResponseBodyWithoutReturnTransfer

warning native on by default

Group: Probable bugs

Detect curl_exec result used as a string or JSON document when a locally created handle is proven never configured with CURLOPT_RETURNTRANSFER true.

Example

<?php
$ch = curl_init('https://example.invalid/'); $body = curl_exec($ch); json_decode($body, true);

Reported:

• line 2: Enable response-body return before decoding curl output.

Detection

• Report curl_exec result used as a string or JSON document when a locally created handle is proven never configured with CURLOPT_RETURNTRANSFER true.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases or recursion cannot establish definite facts. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Unknown handle origins/options, enabled return transfer, custom write callbacks with separately consumed body, and success checks are excluded.
• A handle shared with another variable scope is not proven unconfigured, because that scope can set options without passing the handle to a call visible in the inspected scope. This covers a handle variable, or a local alias of it, listed in a closure use clause, referenced inside an arrow function, or bound by a global statement. Closures, arrow functions and global statements that do not name the handle leave the proof intact, as does a closure that merely declares its own variable of the same name.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

No automatic fix: enabling return transfer changes output behavior and failure handling remains necessary.

PHP versions

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "CurlResponseBodyWithoutReturnTransfer": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore CurlResponseBodyWithoutReturnTransfer