False positives in the effect of file_get_contents() #8440
Description
Bug report
Code snippet that reproduces the problem
The code below is common code for issuing HTTP requests in projects that do not have an HTTP client installed (also known as legacy code).
// In the general case, this line has no effect as detected by PHPStan.
file_get_contents(__DIR__ . '/config');
// This line send a POST request with HTTP, not for GET, as it seems.
file_get_contents(self::URL, false, stream_context_create([
'http' => [
'method' => 'POST',
'header' => 'Content-Type: application/json',
'content' => json_encode($data, JSON_THROW_ON_ERROR),
],
]));https://phpstan.org/r/5ce5f059-a935-4871-9fb0-a2f14e337b35
Expected output
My rule of thumb is that a call passed context argument may have intended side effects.
Continue to warn of side effects when called without context.
Calling file_get_content() without specifying a context will issue a GET method.
Since GET is an idempotent method, the use case of sending a GET request over HTTP to cause side effects is an exception.
Did PHPStan help you today? Did it make you happy in any way?
I like PSR-18 so much that I forgot about file_get_contents() as an HTTP client substitute until I started volunteering to improve my friend's code. PHPStan is also very useful for inspecting such code. ❤️