DstUnsafeCalendarDayArithmetic

warning native off by default

Group: Probable bugs

Detect addition of literal 86400 to a timestamp derived from local midnight in a resolved DST-observing timezone under a daily-calendar scheduling contract.

Example

<?php
$day=new DateTimeImmutable('2025-03-30 00:00:00',new DateTimeZone('Europe/Paris')); $next=$day->getTimestamp()+86400;

Reported:

• line 2: Use calendar arithmetic for the next local day.

Detection

• Report addition of literal 86400 to a timestamp derived from local midnight in a resolved DST-observing timezone under a daily-calendar scheduling contract.
• A timezone counts as DST-observing only when the DateTimeZone argument is a literal Region/City identifier (it contains a /) whose winter and summer offsets differ in the year of the date.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is disabled; enable only when the stated intent matches the application.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases or recursion cannot establish definite facts. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• UTC/fixed-offset zones, elapsed-duration contracts, unknown timezone and calendar modify/add operations are excluded.
• Zone names without a / are never reported: PHP resolves bare abbreviations such as CET, MET, EET or EST to fixed offsets with no transition, and names such as Local or the empty string are not PHP timezones at all. The result must not depend on the timezone of the machine running the analysis.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

No automatic fix: changing representation from elapsed seconds to calendar dates requires intent.

PHP versions

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "DstUnsafeCalendarDayArithmetic": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore DstUnsafeCalendarDayArithmetic