DeflateStreamNeverFinished

warning native off by default PHP ≥ 7.0

Group: Probable bugs

Finish the compressed stream before publishing it. This opt-in rule applies the policy described in Detection.

Example

<?php
$c=deflate_init(ZLIB_ENCODING_GZIP); $out=deflate_add($c,"sample",ZLIB_SYNC_FLUSH); file_put_contents("result.gz",$out);

Reported:

• line 2: Finish the compressed stream before publishing it.

Detection

• Enabled policy requires complete standalone compression streams. Report file_put_contents publishing an unchanged local/direct deflate_add result whose explicit flush constant is ZLIB_SYNC_FLUSH, ZLIB_NO_FLUSH or ZLIB_FULL_FLUSH. The write must replace the file: either no flags argument is passed, or its value resolves to an integer without the FILE_APPEND bit. Concatenated outputs and publication through other consumers remain outside this local subset.
• Resolve builtin functions, extension classes, method receivers, constants and named arguments. Follow unchanged locals and aliases only within the same bounded lexical scope. Require a reachable path; merge branch facts only when all incoming paths establish them.
• Emit one finding at the violating operation, not one per evidence statement. Rebinding, writes, by-reference escape and unresolved calls that can mutate relevant state remove proof. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Exclude shadowed builtins, unresolved receivers, incomplete syntax and unknown prerequisite facts. An extension function name alone does not prove an application function is that builtin.
• An appending write is one piece of a file that a later write can finish. Skip file_put_contents whose flags argument contains FILE_APPEND, and any flags value that cannot be resolved to an integer (parameters, call results, unpacked arguments).
• A dominating valid guard or repair described in Detection prevents the finding. Both legacy noinspection and custos-ignore forms suppress this ID.

Fix

No automatic fix. The required repair depends on error handling, data selection, lifecycle ordering or application policy.

PHP versions

Requires PHP 7.0 or later and the referenced extension API. Respect method-specific introduction versions within PHP 5.3–8.5; unsupported optional APIs cannot establish facts. Named arguments require PHP 8.0 or later.

Configure

In custos.json:

{
  "rules": {
    "DeflateStreamNeverFinished": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore DeflateStreamNeverFinished