Skip to content

Detect FILTER_THROW_ON_FAILURE in filter_input(), filter_var_array() and filter_input_array() - #6514

Merged
ondrejmirtes merged 1 commit into
2.2.xfrom
filter-functions-throw-on-failure
Sep 22, 2026
Merged

ondrejmirtes merged 1 commit into
2.2.xfrom
filter-functions-throw-on-failure

Conversation

@ondrejmirtes

Copy link
Copy Markdown
Member

FILTER_THROW_ON_FAILURE works with all four filter functions — php_filter_call() in php-src is shared by filter_var(), filter_input(), filter_var_array() and filter_input_array() — but only filter_var() was covered.

  • The throw type extension, renamed to FilterFunctionsThrowTypeExtension, reports Filter\FilterFailedException for all four functions. The new FilterFunctionFlagsHelper locates the flags, including the per-key filter specifications of the array variants, where an integer $options is the filter id and carries no flags.
  • FilterVarRule reports the conflicting FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE for the same four functions and handles named arguments, which a rule sees unnormalized.
  • filter_input() throws on a missing input value when FILTER_THROW_ON_FAILURE is set, so its return type no longer includes null/false for it.

The runtime behaviour was checked on PHP 8.5.5: filter_input() throws input value 'foo' not found, filter_var_array() throws for a per-key FILTER_THROW_ON_FAILURE, and the array variants raise the same "cannot use both" ValueError.

User-visible effect: with exceptions.implicitThrows: false, catching Filter\FilterFailedException around the other three functions was reported as a dead catch. With missingCheckedExceptionInThrows, their callers now need the @throws tag, the same as filter_var() callers. With the default implicitThrows: true the calls already had an implicit throw point, so the existing CatchWithUnthrownExceptionRuleTest data passes with and without this change. AbilityToDisableImplicitThrowsTest covers it instead and fails without the change.

Split out of #6112.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SCH8hvECi7zaEUr1Get7sG

…ay()` and `filter_input_array()`

The flag works with all four filter functions, but only `filter_var()`
was covered.

* The throw type extension, renamed to FilterFunctionsThrowTypeExtension,
  reports Filter\FilterFailedException for all four functions.
  FilterFunctionFlagsHelper locates the flags, including the per-key
  filter specifications of the array variants, where an integer
  `$options` is the filter id and carries no flags.
* FilterVarRule reports the conflicting FILTER_NULL_ON_FAILURE and
  FILTER_THROW_ON_FAILURE for the same four functions and handles named
  arguments, which the rule sees unnormalized.
* `filter_input()` throws on a missing input value when
  FILTER_THROW_ON_FAILURE is set, so its return type no longer includes
  null or false for it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SCH8hvECi7zaEUr1Get7sG
@ondrejmirtes
ondrejmirtes merged commit bb2afa0 into 2.2.x Sep 22, 2026
243 of 246 checks passed
@ondrejmirtes
ondrejmirtes deleted the filter-functions-throw-on-failure branch September 22, 2026 09:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant