UntrustedXmlWriterRawContent

warning native on by default

Group: Security

Write untrusted XML content as escaped text.

Example

<?php
function f(XMLWriter $w) { $w->writeRaw($_POST['caption']); }

Reported:

• line 2: Write untrusted XML content as escaped text.

Detection

• XMLWriter writeRaw receives directly or through unchanged local bindings an indexed _GET,_POST, _REQUEST or_COOKIE string. Exclude proven literal content, text(), and values reconstructed by a proven XML parser/serializer. Do not assume arbitrary sanitizers establish safety.
• Resolve builtin functions, extension classes, constants and method receivers, including aliases and supported named arguments. Inspect reachable operations in one lexical scope with bounded local flow.
• Emit one finding per violating operation. Never infer policy from names or comments. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Exclude shadowed or unresolved symbols, incomplete code, unknown required constants, ambiguous receiver identity and unsupported versions. Reassignment, escaping aliases, and unknown calls invalidate dependent flow facts.
• Both @custos-ignore UntrustedXmlWriterRawContent and @noinspection UntrustedXmlWriterRawContent suppress this native rule.

Fix

None. A safe repair requires choosing values, error handling, or application behavior.

PHP versions

Apply throughout PHP 5.3–8.5 only where the extension API and syntax exist. Do not flag API unavailability through this rule.

Options

None. Use normal rule configuration to enable or disable the inspection.

Configure

In custos.json:

{
  "rules": {
    "UntrustedXmlWriterRawContent": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore UntrustedXmlWriterRawContent