FormEncodingUsedForRfc3986Signature

warning native off by default PHP ≥ 5.4

Group: Probable bugs

Form-style query encoding differs from RFC3986 encoding for spaces. Select RFC3986 encoding when the configured signature protocol requires it. This inspection is disabled by default because the intended policy or use can vary.

Example

The positive example requires signatureFunctions: ["signRfc3986"] in this rule’s options. The default empty list establishes no application signature policy.

<?php
function signRfc3986($key){$q=http_build_query(["q"=>"a b"]);return hash_hmac("sha256",$q,$key);}

Reported:

• line 2: Use RFC3986 query encoding for this signature protocol.

Detection

• Resolved http_build_query result is data argument of hash_hmac and a configured signature protocol requires RFC3986 (default empty configured function list; rule disabled by default). Initial explicit evidence is a configured enclosing function fully qualified name; query contains literal space and encoding is absent/PHP_QUERY_RFC1738. Never infer from variable names.
• The literal space is searched in the whole literal query data: string values, string keys, and both again inside nested literal arrays (bounded nesting depth). A key is serialized only together with its value, so a spaced key counts only when its value is provably emitted: a known string or integer, or a nested literal array that itself provably emits a pair.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• A spaced key whose value is null, an empty array, or not statically known is not evidence: PHP drops such a pair entirely or may do so at run time.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Requires PHP 5.4 or later.

Options

Option	Type	Default	Effect
signatureFunctions	list	[]	Fully qualified names of the functions that build RFC 3986 signatures; only queries signed inside one of them are checked.

Configure

In custos.json:

{
  "rules": {
    "FormEncodingUsedForRfc3986Signature": {
      "enabled": true,
      "options": {
        "signatureFunctions": []
      }
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore FormEncodingUsedForRfc3986Signature