UnpackedNamedArgumentCollision

error native on by default PHP ≥ 8.0

Group: Probable bugs

Detect an explicit or unpacked argument binding a parameter already certainly bound by a literal unpacked array on the same call.

Example

<?php
function send($id) {} send(...['id'=>7],id:8);

Reported:

• line 2: Bind each argument only once.

Detection

• Report an explicit or unpacked argument binding a parameter already certainly bound by a literal unpacked array on the same call.
• Model PHP's argument counter when assigning positional values: a positional value takes the slot after the highest parameter slot filled so far, whether that slot was filled positionally or by name. A name collected by a variadic parameter fills no slot and leaves the counter unchanged.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• Unknown spreads, conditional keys, valid disjoint bindings and variadic distinct-name collection are excluded.
• A positional unpacked array following a named unpacked array is not a collision by itself: its values land after the named slot. Only a later argument naming a slot that was really filled is reported.
• A positional value reaching a variadic parameter or a slot beyond the declared parameters binds no name, and a positional element following a named element inside the same unpacked array raises a different runtime error; neither establishes a collision and analysis of the call stops there.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

No automatic fix: choosing which value to retain is application intent.

PHP versions

Available from PHP 8.0. Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "UnpackedNamedArgumentCollision": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore UnpackedNamedArgumentCollision