HttpErrorBodyReadWithoutIgnoreErrors

warning native off by default

Group: Probable bugs

Enable reading HTTP error response bodies. This opt-in inspection applies the policy stated in Detection.

Example

Finding with the rule explicitly enabled:

<?php
$ctx = stream_context_create(["http" => ["ignore_errors" => false]]); file_get_contents("https://service.test/data", false, $ctx);

Reported:

• line 2: Enable reading HTTP error response bodies.

Detection

• Enabled policy requires obtaining HTTP error response bodies. Resolve file_get_contents/fopen over a proven http/https URL with a local stream_context_create HTTP context whose ignore_errors option is absent or false. Report the consuming call. The default option false also violates policy. Named arguments and literal contexts are supported. A read that passes no context uses the default context and is reported too, unless E3 applies.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias, unknown call involving the tracked value or analysis-budget exhaustion. Uncertain facts cannot prove a violation.

Exceptions (no report)

• ignore_errors=true, non-HTTP streams, unknown URL schemes and unknown contexts are excluded. Enabling the rule states the response-body policy; comments or variable names are not evidence.
• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.
• E3. The default stream context is process-wide state. When the analyzed file calls the builtin stream_context_set_default or stream_context_get_default anywhere, a read without a context argument is not reported: the default may already enable ignore_errors. A stream_context_create call whose second (params) argument is not a proven array, or is an array holding an options entry, yields an unknown context, because those options are merged into the ones given first.
• A stream_context_create call given an unpacked argument (...$options) may receive any options or params: its context is unknown.

Fix

No automatic fix. Choosing a repair requires runtime information, error-handling policy or a semantic decision.

All edits use exact byte ranges, preserve comments and evaluation order, and require syntax supported by the target PHP version. A fix must never add an evaluation or silently change unrelated arguments.

PHP versions

Available throughout PHP 5.3–8.5.

Options

None. Enabling the rule declares the policy stated in Detection; the rule is disabled by default.

Configure

In custos.json:

{
  "rules": {
    "HttpErrorBodyReadWithoutIgnoreErrors": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore HttpErrorBodyReadWithoutIgnoreErrors