XmlReaderAttributeCursorNotRestored

warning native off by default

Group: Probable bugs

Restore the XMLReader element cursor before element operations. This inspection is disabled by default; enabling it selects the stated policy.

Example

<?php
function f(XMLReader $r) { if($r->moveToAttribute('key')){ if($r->nodeType === XMLReader::ELEMENT){} } }

Reported:

• line 2: Restore the XMLReader element cursor before element operations.

Detection

• After a proven successful moveToAttribute or moveToFirstAttribute, with no moveToElement/read/next, compare nodeType to XMLReader::ELEMENT or perform element-only handling. Initial supported sink is strict equality with ELEMENT. Enabling establishes that this comparison intends to handle the containing element.
• Only a moveToElement, read or next call on the same reader that runs after the guarding attribute move and on every path to the comparison restores the cursor. The same calls placed before the guard, such as the read that positions the reader on the element in the first place, do not suppress the report.
• Resolve builtin functions, extension classes, constants and method receivers, including aliases and supported named arguments. Inspect reachable operations in one lexical scope with bounded local flow.
• Emit one finding per violating operation. Never infer policy from names or comments. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Exclude shadowed or unresolved symbols, incomplete code, unknown required constants, ambiguous receiver identity and unsupported versions. Reassignment, escaping aliases, and unknown calls invalidate dependent flow facts.
• Both @custos-ignore XmlReaderAttributeCursorNotRestored and @noinspection XmlReaderAttributeCursorNotRestored suppress this native rule.

Fix

None. A safe repair requires choosing values, error handling, or application behavior.

PHP versions

Apply throughout PHP 5.3–8.5 only where the extension API and syntax exist. Do not flag API unavailability through this rule.

Options

None. Use normal rule configuration to enable or disable the inspection.

Configure

In custos.json:

{
  "rules": {
    "XmlReaderAttributeCursorNotRestored": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore XmlReaderAttributeCursorNotRestored