FilteredListJsonShape

warning native off by default quick-fix

Group: Probable bugs

Detect builtin json_encode consuming array_filter on a literal sequential array when default filtering certainly removes an interior element and leaves a later numeric key.

Example

Before

<?php
json_encode(array_filter([1, 0, 2]));

After fix

<?php
json_encode(\array_values(array_filter([1, 0, 2])));

Reported:

• line 2: Reindex the filtered array before encoding a JSON list.

Detection

• Report builtin json_encode consuming array_filter on a literal sequential array when default filtering certainly removes an interior element and leaves a later numeric key.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is disabled; enable only when the stated intent matches the application.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• An explicit JSON_FORCE_OBJECT flag establishes object output intent. Unknown flags cannot prove list output intent and suppress this check.

• Do not report a preserved contiguous list, explicit reindexing, or a deliberately keyed source array.

• Do not report when the literal is reached through a local variable (the filtered array itself, a variable item or key, or a variable one of those was copied from) that can receive another value without a plain assignment in the scope of the call: a closure capturing it by reference, a reference held by an array item, a reference assignment, a by-reference foreach over it, ++ or --, a catch, foreach, global, static or unset binding, or an extract() call. A by-value capture or copy does not suppress the report.

• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

Wrap the filtered result in array_values only when the configured opt-in establishes that JSON list output is intended. Preserve the argument bytes.

A fix is offered only when the concrete prerequisites above are proven. Edits use exact source byte ranges, preserve comments and argument evaluation order, and introduce syntax supported by the configured PHP version. Never invent error-handling policy.

PHP versions

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "FilteredListJsonShape": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore FilteredListJsonShape