VaryHeaderOverwritesEarlierDimensions

warning native off by default

Group: Probable bugs

Retain the earlier Vary dimensions. This opt-in inspection applies the policy stated in Detection.

Example

Finding with the rule explicitly enabled:

<?php
header("Vary: Accept-Encoding"); header("Vary: Accept-Language");

Reported:

• line 2: Retain the earlier Vary dimensions.

Detection

• Enabled policy requires preserving declared cache variation dimensions. Track literal Vary field-name tokens; report a replacement Vary call whose token set omits at least one prior effective dimension. Compare case-insensitively. A replacement with star retains all dimensions.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias, unknown call involving the tracked value or analysis-budget exhaustion. Uncertain facts cannot prove a violation.

Exceptions (no report)

• Appending with replace=false, identical/superset replacement, header_remove, unknown token values and a preceding star followed by star are excluded.
• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

Fix

No automatic fix. Choosing a repair requires runtime information, error-handling policy or a semantic decision.

All edits use exact byte ranges, preserve comments and evaluation order, and require syntax supported by the target PHP version. A fix must never add an evaluation or silently change unrelated arguments.

PHP versions

Available throughout PHP 5.3–8.5.

Options

None. Enabling the rule declares the policy stated in Detection; the rule is disabled by default.

Configure

In custos.json:

{
  "rules": {
    "VaryHeaderOverwritesEarlierDimensions": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore VaryHeaderOverwritesEarlierDimensions