DomElementValueContainsBareAmpersand

warning native on by default

Group: Probable bugs

Append a text node for literal ampersand text.

Example

<?php
$d=new DOMDocument(); $n=$d->createElement('label', 'Salt & pepper');

Reported:

• line 2: Append a text node for literal ampersand text.

Detection

• DOMDocument createElement second argument is a constant string containing an ampersand not starting a syntactically valid numeric reference or a declared/predefined XML entity. Accept amp, lt, gt, apos and quot; custom declarations require proven DTD provenance.
• Resolve builtin functions, extension classes, constants and method receivers, including aliases and supported named arguments. Inspect reachable operations in one lexical scope with bounded local flow.
• Emit one finding per violating operation. Never infer policy from names or comments. When the proof is inconclusive, nothing is reported.

Unknown XML input, unsupported DTD declarations and external subsets do not prove that a named entity is missing. Only a complete locally parsed declaration set establishes that absence. Invalid numeric references remain invalid independently of the document declarations.

A failed XML load preserves the previous document. Declaration evidence from earlier loads therefore remains possible when replaying later load attempts.

Exceptions (no report)

• Exclude shadowed or unresolved symbols, incomplete code, unknown required constants, ambiguous receiver identity and unsupported versions. Reassignment, escaping aliases, and unknown calls invalidate dependent flow facts.
• Both @custos-ignore DomElementValueContainsBareAmpersand and @noinspection DomElementValueContainsBareAmpersand suppress this native rule.

Fix

None. A safe repair requires choosing values, error handling, or application behavior.

PHP versions

Apply throughout PHP 5.3–8.5 only where the extension API and syntax exist. Do not flag API unavailability through this rule. Legacy DOM classes are the initial target; modern Dom namespace classes require independently established matching contracts.

Options

None. Use normal rule configuration to enable or disable the inspection.

Configure

In custos.json:

{
  "rules": {
    "DomElementValueContainsBareAmpersand": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore DomElementValueContainsBareAmpersand