UnknownNamedArgument

error native on by default PHP ≥ 8.0

Group: Probable bugs

Detect a named argument absent from every resolved target parameter list where no target has a variadic parameter.

Example

<?php
function pause($timeout) {} pause(timeot:3);

Reported:

• line 2: Use a declared parameter name.

Detection

• Report a named argument absent from every resolved target parameter list where no target has a variadic parameter. Parameter names are compared case-sensitively.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.
• D4. The resolved targets of a call are every declaration PHP may bind it to:
  • a function call: the builtin of that name, otherwise every project declaration of the function (a function declared several times and loaded conditionally accepts the names of whichever declaration runs);
  • an instance method call: the method as each class of the receiver's type resolves it, plus the method as every indexed subtype of those classes resolves it (own declaration, trait import or inherited), because the runtime object may be any subtype and PHP binds names against the method that actually runs;
  • a static:: call: the method of the enclosing class plus those of its indexed subtypes, as for an instance call;
  • a call through a named class, self or parent: only the method that class resolves.
• Subtypes are not consulted when the nominal method is private or final, or its receiver class is final: no override can replace it.
• D6. A builtin target counts only when its stub parameter names are verified: the declaration belongs to an extension bundled with PHP whose stub names were compared with the engine's reflection, and it is not one of the listed builtins whose stub is known to differ (session_set_cookie_params, dba_fetch, ldap_sasl_bind, IntlCalendar::set).

Exceptions (no report)

• Unresolved targets, variadic collectors, method overload uncertainty and valid inherited parameters are excluded.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.
• No report when any target of D4 is unknown: a receiver class that is not indexed, a class of a union receiver lacking the method, a dynamic method or class name.
• No report when a target is a builtin outside D6 (PECL and other unverified extensions such as Imagick, AMQP or SNMP, and the listed drifted builtins): their stub names document the API but are not the names the extension declares.
• No report when any target, including an override in a subtype, has a variadic parameter, or is declared only by a @method tag (served by __call / __callStatic, which accept any name).
• No report when the receiver class is a trait ($this, self or static inside a trait method): the method runs in the using classes, which may declare the callee with other names.

Fix

No automatic fix: spelling similarity does not prove the intended parameter.

PHP versions

Available from PHP 8.0. Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "UnknownNamedArgument": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore UnknownNamedArgument