DateOnlyParseRetainsCurrentTime

warning native off by default quick-fix

Group: Probable bugs

Detect DateTime or DateTimeImmutable createFromFormat with a format containing calendar-date tokens but no time tokens or reset modifiers.

Example

Before

<?php
$day=DateTimeImmutable::createFromFormat('Y-m-d',$input);

After fix

<?php
$day=DateTimeImmutable::createFromFormat('!Y-m-d',$input);

Reported:

• line 2: Reset omitted time fields when parsing a date-only value.

Detection

• Report DateTime or DateTimeImmutable createFromFormat with a format containing calendar-date tokens but no time tokens or reset modifiers.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is disabled; enable only when the stated intent matches the application.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases or recursion cannot establish definite facts. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Formats containing ! or resetting unspecified fields with a trailing vertical-bar modifier, intentional current-time completion and unknown formats are excluded.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.
• No report when the createFromFormat call (optionally parenthesised) is the direct receiver of a ->setTime(...) or ?->setTime(...) call: that call overwrites every omitted time field, so the current time is never kept. Only the immediate receiver counts; a later setTime statement on a variable and a chained format() are not tracked.

Fix

Prefix the literal format with ! only under this opt-in midnight contract, preserving literal quoting and existing format bytes.

The reset modifier sets every unparsed field to its Unix-epoch value, date fields included. The fix is therefore offered only when the unescaped format tokens supply a year (Y or y), a month (m, n, M or F) and a day of month (d or j). Partial formats such as d/m, F Y or Y take their missing date fields from today; prefixing them with ! would move the result to 1970 or to day 1, so they are reported without a fix. Day-of-year formats (z) are also reported without a fix. Formats that are not a plain single- or double-quoted literal argument are reported without a fix.

A fix is offered only when the concrete prerequisites above are proven. Edits use exact source byte ranges, preserve comments and argument evaluation order, and introduce syntax supported by the configured PHP version. Never invent error-handling policy.

PHP versions

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "DateOnlyParseRetainsCurrentTime": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore DateOnlyParseRetainsCurrentTime