UninitializedTypedPropertyRead

error native on by default PHP ≥ 7.4

Group: Probable bugs

Detect reading a resolved typed instance property when every incoming path proves it remains uninitialized.

Example

<?php
class Meter {public int $value;} echo (new Meter())->value;

Reported:

• line 2: Initialize this typed property before reading it.

Detection

• Report reading a resolved typed instance property when every incoming path proves it remains uninitialized.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• Nullable properties still require initialization; exclude isset/empty checks, explicit defaults, guarded initialization, unknown constructors and magic access.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.
• A guard applies to the whole access chain rooted at the property: when the read is the base of element accesses, property accesses or null-safe property accesses (parenthesized or not) and the outermost link of that chain is an isset/empty operand or the left operand of ??, PHP never raises, so nothing is reported. A method or function call ends the chain, and a read used as an element index or as a dynamic member name is not part of the surrounding chain; those reads still raise and are reported.
• new static may instantiate a subclass whose constructor initializes the property, so it proves a fresh uninitialized instance only when the enclosing class is declared final. new static inside an anonymous class is not reported.

Fix

No automatic fix: an appropriate initial value cannot be inferred.

PHP versions

Available from PHP 7.4. Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "UninitializedTypedPropertyRead": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore UninitializedTypedPropertyRead