ImageEncoderContentTypeMismatch

warning native on by default

Group: Probable bugs

The response content type must describe the image bytes being written. Match it to the selected image encoder.

Example

<?php
header("Content-Type: image/jpeg"); imagepng($im);

Reported:

• line 2: Match the response content type to the image encoder.

Detection

• Resolved header writes a literal Content-Type of image/png, image/jpeg, image/gif, image/webp, image/avif or image/bmp, followed in straight-line scope by a different corresponding image encoder outputting to response (absent/null output path). No intervening content-type header.
• The six listed MIME types are a closed set, compared case-insensitively after dropping parameters. Any other value, including other image/* types and legacy or vendor aliases such as image/jpg, image/pjpeg, image/x-png or image/x-ms-bmp, proves nothing and is not reported.
• The output path is proven absent only when every argument of the encoder call is an ordinary positional or named argument. A call containing an unpacked argument (or written as a first-class callable) may carry the path and is not reported.
• The response-output encoder statement must be the final statement in its lexical block. Account for preceding corrective Content-Type headers and removals; unknown response operations discard the MIME proof. Later statements, corrective headers or unknown calls prevent a finding rather than assuming the earlier MIME header remains final.
• Restrict the initial proof to an encoder that is the final top-level statement in the file. Finality inside a function or nested block cannot establish that later execution leaves the MIME header unchanged, so those contexts are excluded.
• Exclude earlier ob_start calls with any explicitly supplied callback: that callback can transform the eventual output bytes. Scan at most 4096 prior syntax nodes; exhausted scan cannot establish the response MIME proof.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "ImageEncoderContentTypeMismatch": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore ImageEncoderContentTypeMismatch