ParsedQueryValueDecodedTwice

warning native on by default

Group: Probable bugs

parse_str already URL-decodes query values. Avoid a second decoding that changes encoded data into a different value.

Example

<?php
parse_str("next=a%252Fb",$q);$v=urldecode($q["next"]);

Reported:

• line 2: Use the query value without decoding it a second time.

Detection

• Resolved parse_str output literal-key value flows directly into urldecode/rawurldecode without transformation. Require known literal query with a percent-encoded percent sequence yielding a second decodable escape or plus, proving meaning changes.
• Support the decoding call only as a standalone expression statement, the value of a plain assignment whose parent is an expression statement, a direct return value, or the sole expression of an echo statement. Exclude other wrappers and compound expressions: another expression can replace or mutate the parsed output before decoding occurs.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "ParsedQueryValueDecodedTwice": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore ParsedQueryValueDecodedTwice