RegexReplacementCallbackFallsThrough

warning native on by default

Group: Probable bugs

Identify preg_replace_callback with an inline callback having a reachable fallthrough path and no generator semantics. An explicit return on every path excludes.

Detection

• Report preg_replace_callback with an inline callback having a reachable fallthrough path and no generator semantics. An explicit return on every path excludes.
• A path ends, without falling through, at return, throw, exit/die, or a statement whose expression has the resolved type never (a call to a function, static method or instance method declared never). An if with a literal condition contributes only its selected branch; any other if falls through when it has no else or when at least one of its branches does.
• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.
• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values, escaped aliases or exhausted analysis budgets invalidate proof.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• A statement-level call whose target cannot be resolved ends the path as well: a function that is neither a builtin nor a known declaration, a dynamic function call, or a method call on a receiver of unknown type. Such a callee may be declared never, so fallthrough is unproven and nothing is reported.
• Callbacks containing loops, try, switch or goto are not analyzed.
• Both @custos-ignore RegexReplacementCallbackFallsThrough and @noinspection RegexReplacementCallbackFallsThrough suppress this native rule.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Available in PHP 5.3–8.5 where the referenced API exists. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "RegexReplacementCallbackFallsThrough": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore RegexReplacementCallbackFallsThrough