CurlResponseZeroRejected

warning native on by default

Group: Probable bugs

Identify curl_exec result used in a truthiness-based failure branch when the same handle has RETURNTRANSFER proven true, and failure branch throws or returns false. Unknown response still merits this contract warning.

Detection

• Report curl_exec result used in a truthiness-based failure branch when the same handle has RETURNTRANSFER proven true, and failure branch throws or returns false. Unknown response still merits this contract warning.

• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.

• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values or escaped aliases invalidate proof. When the proof is inconclusive, nothing is reported.

• D4. The RETURNTRANSFER proof is the result of replaying, in source order, every dominating curl_setopt and curl_setopt_array write on the handle. A truthy CURLOPT_RETURNTRANSFER establishes it; a falsy or unknown value clears it. CURLOPT_FILE and CURLOPT_WRITEFUNCTION replace the write sink, so curl_exec returns a boolean again: they clear the proof until a later truthy CURLOPT_RETURNTRANSFER. Any other option named by a builtin constant leaves it unchanged.

• The failure condition must negate the call an odd number of times, counting each ! and each loose == false between the call and the if. Parentheses and assignments are transparent.

• A failure test must select a falsy result: count negation and loose equality with literal false, on either side, by parity. Parentheses, error suppression and the right-hand value of a plain non-reference assignment preserve the test. Compound assignments and assignment targets do not.

• Require every supported path through the failure body to throw or return literal false. A conditional rejection alone is insufficient. Structured blocks and conditional branches are bounded; suspension, jumps, unsupported control flow and budget exhaustion establish no rejection proof.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• No report when a write on the handle cannot be read: a curl_setopt whose option is not a builtin constant (variable, class constant, user constant, number), or a curl_setopt_array whose options are not a literal array with builtin constant keys. Such a write may disable RETURNTRANSFER, so it clears the proof like D4's sink options.
• No report for an even number of negations such as !!curl_exec($ch); that branch runs when a body was received.
• Both @custos-ignore CurlResponseZeroRejected and @noinspection CurlResponseZeroRejected suppress this native rule.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Available in PHP 5.3–8.5 where the referenced API exists. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "CurlResponseZeroRejected": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore CurlResponseZeroRejected