XPathIgnoresDefaultNamespace

warning native on by default

Group: Probable bugs

Unprefixed XPath names do not select elements in a nonempty default namespace. Register and use a prefix for that namespace.

Example

<?php
$d=new DOMDocument();$d->loadXML('<root xmlns="urn:demo"><item/></root>');$x=new DOMXPath($d);$x->query("//item");

Reported:

• line 2: Register a namespace prefix for the XPath query.

Detection

• A local DOMDocument loads a literal XML root with a nonempty default xmlns and no unnamespaced matching descendant. A DOMXPath created for that document queries a literal //NAME path corresponding to a namespaced element, without registered prefix in the query.
• The evidence must be three adjacent statements of one block: the loadXML call as a statement of its own, then the assignment of the new DOMXPath, then the statement holding the query. Nothing can then mutate, reload or replace the document between the load and the query.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Unknown XML, complex XPath, namespace resets, or intervening document mutations have no report.
• Any statement between the loadXML call and the DOMXPath construction withholds the report, whatever it does: appending or importing nodes, load, loadHTML, loadHTMLFile, or unrelated code. A loadXML call whose result is assigned or tested is likewise not accepted as evidence.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "XPathIgnoresDefaultNamespace": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore XPathIgnoresDefaultNamespace