EncodingConversionArgumentsReversed

warning native off by default

Group: Probable bugs

Converting text away from the output consumer's required encoding can make it invalid input. Convert to the encoding required by the consumer. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
$s=mb_convert_encoding("été","ISO-8859-1","UTF-8");echo json_encode($s);

Reported:

• line 2: Convert to the encoding required by the output consumer.

Detection

• Resolved mb_convert_encoding has literal source/target encodings differing; converted result enters json_encode or response echo with definite Content-Type charset matching the input encoding. Require literal input valid only in claimed source encoding or proven upstream encode contract; variable names do not establish encoding.
• The initial proof requires a valid non-ASCII UTF-8 literal converted to ISO-8859-1 and passed to json_encode, where the resulting bytes are not valid UTF-8. ASCII-only text is excluded.
• Compute the supported literal conversion and prove the resulting Latin-1 bytes are invalid UTF-8. Exclude converted bytes that already form valid UTF-8, even when the source literal contains non-ASCII code points; not every Latin-1 byte sequence is invalid UTF-8.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "EncodingConversionArgumentsReversed": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore EncodingConversionArgumentsReversed