SharedLockUsedForWriting

warning native on by default

Group: Probable bugs

A shared lock does not provide exclusive access for a write. Acquire an exclusive lock before changing the protected stream.

Example

<?php
$h=tmpfile();flock($h,LOCK_SH);fwrite($h,$data);
$g=tmpfile();flock($g,LOCK_NB|LOCK_SH);ftruncate($g,0);

Reported:

• line 2: Acquire an exclusive lock before writing.
• line 3: Acquire an exclusive lock before writing.

Detection

• Resolved flock(handle,LOCK_SH optionally OR LOCK_NB) precedes fwrite/fputs/ftruncate on same simple-local handle before unlock/exclusive-lock change. Unknown handle escape invalidates proof.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Do not report when any flock call lies between the proven shared lock and the write, in any statement position (an if condition, a guard that throws, a conditional block, a short-circuit operand), unless that call's mode is itself provably LOCK_SH (optionally OR LOCK_NB) or its handle is proven to be a different stream. A checked upgrade such as if (flock($h, LOCK_EX)) { fwrite($h, $data); } is therefore valid.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "SharedLockUsedForWriting": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore SharedLockUsedForWriting