Fix phpstan/phpstan#14397: FILTER_FLAG_GLOBAL_RANGE constant not "known" on PHP 8.3, 8.4 by phpstan-bot · Pull Request #5334 · phpstan/phpstan-src

phpstan-bot · 2026-03-29T18:59:12Z

Summary

On PHP 8.3/8.4, using FILTER_FLAG_GLOBAL_RANGE with filter_var caused a false positive: "Strict comparison using === between non-falsy-string and false will always evaluate to false." This happened because FILTER_FLAG_GLOBAL_RANGE (268435456) shares the same numeric value as FILTER_THROW_ON_FAILURE on those PHP versions, causing PHPStan to incorrectly infer the function would throw instead of returning false.

Changes

Gate FILTER_THROW_ON_FAILURE checks behind PHP >= 8.5 in src/Type/Php/FilterFunctionReturnTypeHelper.php (two locations)
Add PHP version check to src/Type/Php/FilterVarThrowTypeExtension.php in isFunctionSupported()
Add PHP version check to src/Rules/Functions/FilterVarRule.php for the null-on-failure + throw-on-failure conflict detection

Root cause

The JetBrains PHP stubs define FILTER_THROW_ON_FAILURE with value 268435456 without any PHP version guard. On PHP 8.3/8.4, FILTER_FLAG_GLOBAL_RANGE also has value 268435456 (changed to 536870912 in PHP 8.5 to avoid this exact collision). When PHPStan checked whether FILTER_THROW_ON_FAILURE was present in the flags via bitwise AND, it matched FILTER_FLAG_GLOBAL_RANGE and incorrectly removed false from the return type, since throw-on-failure means the function throws instead of returning a failure value.

Test

Added tests/PHPStan/Analyser/nsrt/bug-14397.php — asserts that filter_var($ipAddress, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_GLOBAL_RANGE) returns non-falsy-string|false (not just non-falsy-string).

Fixes phpstan/phpstan#14397

spaze · 2026-03-29T20:43:19Z

Oh I see now, PHP 8.5 has introduced FILTER_THROW_ON_FAILURE and they put it in the middle of the flags bitmask moving the existing FILTER_FLAG_GLOBAL_RANGE to another bit. Not sure it was necessary though https://github.com/php/php-src/pull/18896/changes#diff-907132129e0423785307f3458a266f347c35b2899eebf77c8981fef38409e8a8

And JetBrains stubs list them with the same value
https://github.com/JetBrains/phpstorm-stubs/blob/3327932472f512d2eb9e122b19702b335083fd9d/filter/filter.php#L531-L538

Thanks for the fix! :-)

… PHP 8.3/8.4 - FILTER_FLAG_GLOBAL_RANGE (268435456) has the same numeric value as FILTER_THROW_ON_FAILURE on PHP 8.3/8.4 - This caused PHPStan to incorrectly think filter_var would throw, removing false from the return type - Gate all FILTER_THROW_ON_FAILURE checks behind PHP >= 8.5 (where the constant was introduced) - Applied fix to FilterFunctionReturnTypeHelper, FilterVarThrowTypeExtension, and FilterVarRule - Updated FilterVarRuleTest to pass new PhpVersion constructor parameter - New regression test in tests/PHPStan/Analyser/nsrt/bug-14397.php

VincentLanglet

Replace the check

$this->phpVersion->getVersionId() >= 80500

by a dedicated method inside phpVersion.

hasFilterThrowOnFailureConstant()

…stant() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phpstan-bot · 2026-03-30T10:00:05Z

Done. Added hasFilterThrowOnFailureConstant() method to PhpVersion and replaced all three raw getVersionId() >= 80500 checks in FilterVarRule, FilterFunctionReturnTypeHelper, and FilterVarThrowTypeExtension. Tests and static analysis both pass.

src/Type/Php/FilterVarThrowTypeExtension.php

src/Rules/Functions/FilterVarRule.php

- Add nsrt test verifying filter_var with FILTER_THROW_ON_FAILURE still returns false on PHP < 8.5 (throw type extension correctly inactive) - Add FilterVarRule test verifying no error for FILTER_NULL_ON_FAILURE + FILTER_THROW_ON_FAILURE combination on PHP < 8.5 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

staabm · 2026-03-30T11:36:07Z

tests/PHPStan/Rules/Functions/data/filter_var_null_and_throw_pre_php85.php

@@ -0,0 +1,14 @@
+<?php // lint < 8.5
+
+namespace FilterVarNullAndThrowPrePhp85;


should we test this file on 8.5+ and pre-8.5?

Done. Added a test (testRuleGlobalRangePhp85) that verifies FILTER_FLAG_GLOBAL_RANGE|FILTER_NULL_ON_FAILURE produces no false positive on PHP 8.5+, complementing the existing pre-8.5 test. All tests (11701) and static analysis pass. Changes pushed.

Ensures FILTER_FLAG_GLOBAL_RANGE|FILTER_NULL_ON_FAILURE does not falsely trigger the "cannot use both" error on PHP 8.5+ where the constants have distinct values. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

staabm · 2026-03-30T11:43:48Z

src/Rules/Functions/FilterVarRule.php

+			return [];
+		}
+
+		if (count($args) < 3) {


I think we should count args right after if (!($node->name instanceof Node\Name)) { to exit early with a cheap check

Tests also confirmed passing. Everything's been pushed — the review comment from staabm has been addressed.

staabm

lgtm

…checks in FilterVarRule Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

VincentLanglet force-pushed the create-pull-request/patch-yzr5t1i branch from 5a53072 to fa75094 Compare March 30, 2026 09:52

VincentLanglet requested changes Mar 30, 2026

View reviewed changes

Replace raw version check with PhpVersion::hasFilterThrowOnFailureCon…

94b3785

…stant() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

VincentLanglet reviewed Mar 30, 2026

View reviewed changes

src/Type/Php/FilterVarThrowTypeExtension.php Outdated Show resolved Hide resolved

src/Rules/Functions/FilterVarRule.php Outdated Show resolved Hide resolved

phpstan-bot and others added 4 commits March 30, 2026 10:11

Update tests

0608ee0

Fix

5d6f582

Fix

b46cca1

VincentLanglet approved these changes Mar 30, 2026

View reviewed changes

VincentLanglet requested a review from staabm March 30, 2026 11:20

staabm reviewed Mar 30, 2026

View reviewed changes

VincentLanglet and others added 2 commits March 30, 2026 13:40

Refacto

001b55d

Add FilterVarRule test for FILTER_FLAG_GLOBAL_RANGE on PHP 8.5+

b4f3ef5

Ensures FILTER_FLAG_GLOBAL_RANGE|FILTER_NULL_ON_FAILURE does not falsely trigger the "cannot use both" error on PHP 8.5+ where the constants have distinct values. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

staabm reviewed Mar 30, 2026

View reviewed changes

staabm approved these changes Mar 30, 2026

View reviewed changes

Move args count check before expensive phpVersion/reflectionProvider …

d657e3b

…checks in FilterVarRule Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

VincentLanglet merged commit 6f4489a into phpstan:2.1.x Mar 30, 2026
652 of 655 checks passed

VincentLanglet deleted the create-pull-request/patch-yzr5t1i branch March 30, 2026 12:10

phpstan-bot mentioned this pull request Mar 30, 2026

FILTER_FLAG_GLOBAL_RANGE constant not "known" on PHP 8.3, 8.4 phpstan/phpstan#14397

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix phpstan/phpstan#14397: FILTER_FLAG_GLOBAL_RANGE constant not "known" on PHP 8.3, 8.4#5334

Fix phpstan/phpstan#14397: FILTER_FLAG_GLOBAL_RANGE constant not "known" on PHP 8.3, 8.4#5334
VincentLanglet merged 9 commits intophpstan:2.1.xfrom
phpstan-bot:create-pull-request/patch-yzr5t1i

phpstan-bot commented Mar 29, 2026

Uh oh!

spaze commented Mar 29, 2026

Uh oh!

VincentLanglet left a comment

Uh oh!

phpstan-bot commented Mar 30, 2026

Uh oh!

Uh oh!

Uh oh!

staabm Mar 30, 2026

Uh oh!

phpstan-bot Mar 30, 2026

Uh oh!

staabm Mar 30, 2026 •

edited

Loading

Uh oh!

phpstan-bot Mar 30, 2026

Uh oh!

staabm left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -0,0 +1,14 @@
		<?php // lint < 8.5

		namespace FilterVarNullAndThrowPrePhp85;

Conversation

phpstan-bot commented Mar 29, 2026

Summary

Changes

Root cause

Test

Uh oh!

spaze commented Mar 29, 2026

Uh oh!

VincentLanglet left a comment

Choose a reason for hiding this comment

Uh oh!

phpstan-bot commented Mar 30, 2026

Uh oh!

Uh oh!

Uh oh!

staabm Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

phpstan-bot Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

staabm Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

phpstan-bot Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

staabm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

staabm Mar 30, 2026 •

edited

Loading