StringRepeatNegativeCount

error native on by default

Group: Probable bugs

Identify str_repeat when times is a proven negative integer.

Detection

• Report str_repeat when times is a proven negative integer.
• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.
• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values, escaped aliases or exhausted analysis budgets invalidate proof.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• Integer intervals report only when every value is negative. A bound that changes inside a loop is widened after the loop's second pass, and integer comparisons narrow the values seen in their body. Arithmetic that may overflow PHP integers loses its integer proof. Straight-line code from the start of the scope, without loops, can also establish a negative first read before a later rewrite; unknown branches, prior calls, references and unsupported operations end that additional proof. Fresh assignments supersede earlier steps or extract calls, and merely creating an uninvoked capture does not execute its body. Unknown or crossing intervals give no finding without a concrete entry witness.
• Both @custos-ignore StringRepeatNegativeCount and @noinspection StringRepeatNegativeCount suppress this native rule.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Available in PHP 5.3–8.5 where the referenced API exists. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "StringRepeatNegativeCount": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore StringRepeatNegativeCount