EnumFromUncheckedExternalValue

warning native off by default PHP ≥ 8.1

Group: Probable bugs

Detect a resolved backed enum from call with a request-derived backing value not proven within its declared case set and without handling ValueError.

Example

<?php
enum Phase:string {case Ready='ready';} $p=Phase::from($_GET['phase']);

Reported:

• line 2: Handle unknown enum backing values explicitly.

Detection

• Report a resolved backed enum from call with a request-derived backing value not proven within its declared case set and without handling ValueError.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is disabled; enable only when the stated intent matches the application.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases or recursion cannot establish definite facts. When the proof is inconclusive, nothing is reported.
• A ValueError handler counts only when the call sits in the try body of a statement whose catch clauses name ValueError, Error or Throwable. A call placed in a catch or finally block of that statement is not covered by it, though an outer try may still cover it.
• Guards and handlers are looked up inside the function-like body that contains the call. A closure or arrow function runs later, so a try block or membership check surrounding its creation proves nothing about the call inside it.

Exceptions (no report)

• Known valid backing constants, tryFrom, validation establishing membership, and a catching error handler are excluded.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

No automatic fix: choosing null fallback versus throwing is a caller contract.

PHP versions

Available from PHP 8.1. Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "EnumFromUncheckedExternalValue": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore EnumFromUncheckedExternalValue