JsonEncodeFlagPassedToDecode

warning native on by default PHP ≥ 5.4

Group: Probable bugs

JSON encoding flags do not describe the intended decoding policy. Use the constants supported by json_decode.

Example

<?php
json_decode($json,true,512,JSON_PRETTY_PRINT);

Reported:

• line 2: Use decoding flags in json_decode.

Detection

• Resolved json_decode fourth flags argument syntactically includes an encoding-only resolved JSON constant: JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS, JSON_HEX_QUOT, JSON_FORCE_OBJECT, JSON_NUMERIC_CHECK, JSON_UNESCAPED_SLASHES, JSON_PRETTY_PRINT, JSON_UNESCAPED_UNICODE, JSON_PARTIAL_OUTPUT_ON_ERROR, or JSON_PRESERVE_ZERO_FRACTION. Shared decode-valid flags are excluded.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Requires PHP 5.4 or later.

Configure

In custos.json:

{
  "rules": {
    "JsonEncodeFlagPassedToDecode": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore JsonEncodeFlagPassedToDecode