PdoFetchBothLeaksDuplicateColumns

warning native off by default

Group: Probable bugs

PDO's combined fetch mode exposes numeric and named copies of each field. Select the intended row representation before JSON serialization. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
function bad(PDOStatement $s){json_encode($s->fetchAll(PDO::FETCH_BOTH));}

Reported:

• line 2: Use associative fetch mode before serializing rows.

Detection

• Resolved PDOStatement::fetchAll explicitly uses PDO::FETCH_BOTH and its result is supplied to resolved json_encode without shape conversion. Flag opt-in because duplicate numeric/name representation can be intended.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Do not report a variable argument when a foreach in the same lexical scope iterates that variable binding its elements by reference (as &$row, as $k => &$row, or a destructuring target holding a & slot). Such a loop can replace every row in place, so the serialized shape is no longer proven. A by-reference loop inside a nested closure or function concerns another variable and does not count.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "PdoFetchBothLeaksDuplicateColumns": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore PdoFetchBothLeaksDuplicateColumns