TransferEncodingWithContentLength

warning native on by default

Group: Probable bugs

Choose a single HTTP message framing mechanism.

Example

Finding:

<?php
header("Transfer-Encoding: chunked"); header("Content-Length: 12");

Reported:

• line 2: Choose a single HTTP message framing mechanism.

Detection

• Track effective Transfer-Encoding and Content-Length headers set by builtin header in the same straight-line response segment. Report the second header establishing both. Header replacement and header_remove update state; either order is supported.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias, unknown call involving the tracked value or analysis-budget exhaustion. Uncertain facts cannot prove a violation.

Exceptions (no report)

• A removal before the second header and unknown/branch-dependent header state are excluded. This rule checks HTTP/1.1 sender framing; manually setting Transfer-Encoding for other protocols is not legitimized.
• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

Fix

No automatic fix. Choosing a repair requires runtime information, error-handling policy or a semantic decision.

All edits use exact byte ranges, preserve comments and evaluation order, and require syntax supported by the target PHP version. A fix must never add an evaluation or silently change unrelated arguments.

PHP versions

Available throughout PHP 5.3–8.5.

Configure

In custos.json:

{
  "rules": {
    "TransferEncodingWithContentLength": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore TransferEncodingWithContentLength