JsonIntegerPrecisionLoss

warning native off by default quick-fix

Group: Probable bugs

Detect json_decode on literal JSON containing an integer outside the portable signed 64-bit range without JSON_BIGINT_AS_STRING.

Example

Before

<?php
$data = json_decode('{"id":9223372036854775808}', true);

After fix

<?php
$data = json_decode('{"id":9223372036854775808}', true, 512, \JSON_BIGINT_AS_STRING);

Reported:

• line 2: Preserve large JSON integers as strings.

Detection

• Report json_decode on literal JSON containing an integer outside the portable signed 64-bit range without JSON_BIGINT_AS_STRING.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is disabled; enable only when the stated intent matches the application.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• Existing flag, deliberately floating-point values, unknown JSON bytes, and custom decoding wrappers are excluded.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

On PHP 5.4 or later, add JSON_BIGINT_AS_STRING to the flags argument only under this opt-in exact-integer contract; preserve other flag expressions and positional/named binding. PHP 5.3 receives the diagnostic without an automatic fix because its decoder has no flags argument.

A fix is offered only when the concrete prerequisites above are proven. Edits use exact source byte ranges, preserve comments and argument evaluation order, and introduce syntax supported by the configured PHP version. Never invent error-handling policy.

PHP versions

Detection applies across PHP 5.3–8.5. The automatic fix requires PHP 5.4 or later, when the flags argument and JSON_BIGINT_AS_STRING became available; see the PHP 5.4 JSON implementation.

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "JsonIntegerPrecisionLoss": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore JsonIntegerPrecisionLoss