DomLiveNodeListRemovalSkipsNodes

warning native on by default

Group: Probable bugs

Remove live DOM matches without skipping shifted nodes.

Example

<?php
function f(DOMDocument $d) { $nodes=$d->getElementsByTagName('part'); for($i=0;$i<$nodes->length;$i++){ $n=$nodes->item($i); $n->parentNode->removeChild($n); } }

Reported:

• line 2: Remove live DOM matches without skipping shifted nodes.

Detection

• A forward for loop starts index at zero, tests index against a live getElementsByTagName/getElementsByTagNameNS result length, increments by one, and unconditionally removes item(index) from its parent. The removed node is either a local bound to item(index) earlier in the loop body, or the unbound form where the parentNode receiver and the removeChild argument are the same item(index) call written twice. Exclude backwards loops, snapshots, index correction and removals outside this exact pattern.
• Resolve builtin functions, extension classes, constants and method receivers, including aliases and supported named arguments. Inspect reachable operations in one lexical scope with bounded local flow.
• Emit one finding per violating operation. Never infer policy from names or comments. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Exclude shadowed or unresolved symbols, incomplete code, unknown required constants, ambiguous receiver identity and unsupported versions. Reassignment, escaping aliases, and unknown calls invalidate dependent flow facts.
• Statements following the removal in the loop body can compensate for the shift. No report when any of them, at any nesting depth, mentions the index variable (decrement, reassignment, passing it on), uses a variable variable, or leaves the iteration through break, continue, return, goto, throw or exit. Later statements that touch neither keep the report.
• Both @custos-ignore DomLiveNodeListRemovalSkipsNodes and @noinspection DomLiveNodeListRemovalSkipsNodes suppress this native rule.

Fix

None. A safe repair requires choosing values, error handling, or application behavior.

PHP versions

Apply throughout PHP 5.3–8.5 only where the extension API and syntax exist. Do not flag API unavailability through this rule. Legacy DOM classes are the initial target; modern Dom namespace classes require independently established matching contracts.

Options

None. Use normal rule configuration to enable or disable the inspection.

Configure

In custos.json:

{
  "rules": {
    "DomLiveNodeListRemovalSkipsNodes": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore DomLiveNodeListRemovalSkipsNodes