Fix phpstan/phpstan#14241: Cannot re-assign auto-global variable in parameters by phpstan-bot · Pull Request #5153 · phpstan/phpstan-src

phpstan-bot · 2026-03-08T21:47:11Z

Summary

PHP throws a fatal error when a superglobal variable name (like $_FILES, $_GET, $_POST, etc.) is used as a function, method, or closure parameter. PHPStan was not detecting this and only reported missing type hints, missing the more fundamental issue.

Changes

Added src/Rules/Functions/SuperGlobalParameterRule.php — a new level-0 rule that checks all FunctionLike nodes for parameters named after superglobal variables
Added tests/PHPStan/Rules/Functions/SuperGlobalParameterRuleTest.php with test covering all superglobal variables across functions, methods, closures, and arrow functions
Added tests/PHPStan/Rules/Functions/data/bug-14241.php — test data file
Updated Makefile to exclude the test data file from PHP lint (since PHP itself cannot parse files with superglobal parameters)

Root cause

There was no rule checking whether function/method/closure parameters use superglobal variable names. PHP prohibits this at the parser level with "Cannot re-assign auto-global variable" fatal error, but PHPStan's parser (nikic/php-parser) successfully parses the code without error. A dedicated rule was needed to replicate this PHP compile-time check.

Test

The regression test SuperGlobalParameterRuleTest::testRule() verifies that errors are reported for $_FILES, $_GET, $_POST, $_SERVER, $_SESSION, $_COOKIE, $_REQUEST, $_ENV, and $GLOBALS when used as parameters in functions, methods, closures, and arrow functions. Regular parameter names like $ok produce no error.

Fixes phpstan/phpstan#14241

src/Rules/Functions/SuperGlobalParameterRule.php

src/Rules/Functions/InvalidParameterNameRule.php

staabm · 2026-03-09T10:28:21Z

(requesting ondrejs review, as we are adding a new rule)

phpstan-bot · 2026-03-20T09:11:53Z

Tests pass. The review from staabm is just an approval — no changes were requested. The PR is ready to merge as-is.

staabm

test bot reaction after rebase to latest action workflows

ondrejmirtes · 2026-03-23T08:14:45Z

src/Rules/Functions/InvalidParameterNameRule.php

+			$variableName = $param->var->name;
+
+			if (in_array($variableName, Scope::SUPERGLOBAL_VARIABLES, true)) {
+				$errors[] = RuleErrorBuilder::message(sprintf('Cannot re-assign auto-global variable $%s.', $variableName))


What does auto-global mean? I've never heard that phrase. Are there non-auto-global variables as well?

Already handled — make tests passed (11625 tests, 78861 assertions), and all changes have been committed and pushed.

auto-global is a term from php-src.
see e.g. https://github.com/search?q=repo%3Aphp%2Fphp-src%20auto-global&type=code

it describes the super-global variables $_GET, $_POST etc, and also contains other magic ones like $argc, $argv.

there is even a php.ini settings for auto-globals in jit:
https://www.php.net/manual/en/ini.core.php#ini.auto-globals-jit

I've always used and only heard superglobals

me too. the error message here got inspiration from a php-src native error: https://3v4l.org/1rJJM#veol

ondrejmirtes · 2026-03-23T08:16:33Z

src/Rules/Functions/InvalidParameterNameRule.php

+			$variableName = $param->var->name;
+
+			if (in_array($variableName, Scope::SUPERGLOBAL_VARIABLES, true)) {
+				$errors[] = RuleErrorBuilder::message(sprintf('Cannot re-assign auto-global variable $%s.', $variableName))


The message is also weird. Global variables can be reassigned: https://3v4l.org/gE100#v8.5.3

The message should also contain something about a parameter.

ondrejmirtes · 2026-03-23T08:17:15Z

src/Rules/Functions/InvalidParameterNameRule.php

+
+	public function getNodeType(): string
+	{
+		return Node\FunctionLike::class;


Why not hook the rule onto Param?

ondrejmirtes

Much better. Now please rebase on top of origin/2.1.x and fix the conflict in Makefile.

staabm · 2026-03-23T08:30:25Z

tests/PHPStan/Rules/Functions/data/bug-14241.php

@@ -0,0 +1,26 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14241;


we should have another test for

<?php // This should work, but *not* generate a binding for $GLOBALS $a = 123; $fn = fn() => $GLOBALS['a']; var_dump($fn());

which should not produce a error.

see

https://3v4l.org/Hj3Ki

https://github.com/php/php-src/blob/00c0a9ba308c899e08a6e959b669092b9b976b1b/Zend/tests/arrow_functions/004.phpt#L2

There's no Param in that code so the rule won't trigger at all.

…arameters - Added SuperGlobalParameterRule to detect superglobal variable names used as function/method/closure parameters - PHP throws a fatal error for this (e.g. `function doFoo($_FILES): void {}`), but PHPStan was not reporting it - New regression test in tests/PHPStan/Rules/Functions/data/bug-14241.php - Excluded test data file from Makefile lint step since PHP cannot parse files with superglobal parameters

- Change rule to listen on Node\Param instead of Node\FunctionLike - Replace "Cannot re-assign auto-global variable" with clearer "Superglobal variable $X cannot be used as a parameter." - Use distinct identifiers: parameter.superglobal and parameter.this Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

VincentLanglet reviewed Mar 8, 2026

View reviewed changes

src/Rules/Functions/SuperGlobalParameterRule.php Outdated Show resolved Hide resolved

clxmstaab force-pushed the create-pull-request/patch-lgqy7io branch from a2ae368 to ba7f36d Compare March 9, 2026 10:23

staabm reviewed Mar 9, 2026

View reviewed changes

src/Rules/Functions/InvalidParameterNameRule.php Outdated Show resolved Hide resolved

VincentLanglet approved these changes Mar 9, 2026

View reviewed changes

staabm requested a review from ondrejmirtes March 9, 2026 10:28

staabm assigned ondrejmirtes Mar 10, 2026

VincentLanglet force-pushed the create-pull-request/patch-lgqy7io branch from ba7f36d to e7b86ab Compare March 19, 2026 22:29

VincentLanglet requested a review from staabm March 20, 2026 08:31

staabm approved these changes Mar 20, 2026

View reviewed changes

staabm force-pushed the create-pull-request/patch-lgqy7io branch from e7b86ab to dff450d Compare March 20, 2026 09:16

staabm approved these changes Mar 20, 2026

View reviewed changes

ondrejmirtes requested changes Mar 23, 2026

View reviewed changes

staabm reviewed Mar 23, 2026

View reviewed changes

phpstan-bot and others added 3 commits March 23, 2026 09:58

Rework

4f0c9d4

ondrejmirtes force-pushed the create-pull-request/patch-lgqy7io branch from ed952fa to 6eb1bb1 Compare March 23, 2026 08:58

ondrejmirtes approved these changes Mar 23, 2026

View reviewed changes

ondrejmirtes merged commit e71c437 into phpstan:2.1.x Mar 23, 2026
125 checks passed

ondrejmirtes deleted the create-pull-request/patch-lgqy7io branch March 23, 2026 08:59

phpstan-bot mentioned this pull request Mar 23, 2026

Cannot re-assign auto-global variable in parameters phpstan/phpstan#14241

Closed

		@@ -0,0 +1,26 @@
		<?php declare(strict_types = 1);

		namespace Bug14241;

Conversation

phpstan-bot commented Mar 8, 2026

Summary

Changes

Root cause

Test

Uh oh!

Uh oh!

Uh oh!

staabm commented Mar 9, 2026

Uh oh!

phpstan-bot commented Mar 20, 2026

Uh oh!

staabm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ondrejmirtes left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants