Report invalid $flags constants for preg_replace_callback() and preg_replace_callback_array() - #6019
Merged
staabm merged 1 commit intoJul 8, 2026
Conversation
…preg_replace_callback_array()` - Add `preg_replace_callback` and `preg_replace_callback_array` entries to resources/constantToFunctionParameterMap.php, so their `$flags` bitmask parameters only accept `PREG_OFFSET_CAPTURE` and `PREG_UNMATCHED_AS_NULL` (the same constants already whitelisted for `preg_match`). - The rest of the PCRE family (`preg_match`, `preg_match_all`, `preg_split`, `preg_grep`) was already covered; `preg_replace` and `preg_quote` have no constant flags. The other constant-flag families in the map (JSON, sorting, HTML entities, filter, libxml, ...) were probed and are already complete. - Extend the constant-parameter-check regression data and test with wrong, single-correct and bitmask-correct `$flags` for both functions.
staabm
approved these changes
Jul 8, 2026
VincentLanglet
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
preg_replace_callback()andpreg_replace_callback_array()accept anint $flagsbitmask that only supportsPREG_OFFSET_CAPTUREandPREG_UNMATCHED_AS_NULL, but PHPStan did not validate the constants passed there. Passing an unrelated PCRE constant (e.g.PREG_SPLIT_NO_EMPTY) went unreported. This change registers both functions in the constant-to-parameter map so invalid$flagsconstants are now reported.Changes
resources/constantToFunctionParameterMap.php: addedpreg_replace_callback(flags, bitmask) andpreg_replace_callback_array(flags, bitmask) entries, each allowingPREG_OFFSET_CAPTUREandPREG_UNMATCHED_AS_NULL.tests/PHPStan/Rules/Functions/data/constant-parameter-check.php: added calls with a wrong constant, a correct constant, and a correct bitmask for both functions.tests/PHPStan/Rules/Functions/CallToFunctionParametersRuleTest.php: added the two expected errors.Root cause
The recently introduced
constantToFunctionParameterMap.phpwhitelists which constants each function's flag/mode parameter accepts. The PCRE family was only partially populated —preg_match,preg_match_all,preg_splitandpreg_grepwere present, but the two callback-based replacers (whose$flagsparameter was added in PHP 7.4) were omitted, so their flags parameter was never checked.I probed the sibling constructs on the same axis:
preg_replace_callbackandpreg_replace_callback_array— both are now covered.preg_replace/preg_quotehave no constant flags.Test
CallToFunctionParametersRuleTest::testConstantParameterChecknow asserts two additional errors (PREG_SPLIT_NO_EMPTYrejected forpreg_replace_callback$flagsandpreg_replace_callback_array$flags), and confirms the correct single/bitmask constants produce no error. The test fails before the map change and passes after it.ConstantToFunctionParameterMapTestvalidates the new entries against reflection.Fixes phpstan/phpstan#11437
Closes phpstan/phpstan#14910