Improve curl_init() return type analysis

Author: tscni

src/Type/Php/CurlInitReturnTypeExtension.php

@@ -4,17 +4,32 @@
 
 use PhpParser\Node;
 use PHPStan\Analyser\Scope;
+use PHPStan\Php\PhpVersion;
 use PHPStan\Reflection\FunctionReflection;
 use PHPStan\Reflection\ParametersAcceptorSelector;
+use PHPStan\ShouldNotHappenException;
 use PHPStan\Type\Constant\ConstantBooleanType;
 use PHPStan\Type\DynamicFunctionReturnTypeExtension;
+use PHPStan\Type\NeverType;
 use PHPStan\Type\Type;
 use PHPStan\Type\TypeCombinator;
 use function count;
+use function is_string;
+use function parse_url;
+use function str_contains;
+use function strcasecmp;
+use function strlen;
 
 class CurlInitReturnTypeExtension implements DynamicFunctionReturnTypeExtension
 {
 
+	/** @see https://github.com/curl/curl/blob/curl-8_9_1/lib/urldata.h#L135 */
+	private const CURL_MAX_INPUT_LENGTH = 8000000;
+
+	public function __construct(private PhpVersion $phpVersion)
+	{
+	}
+
 	public function isFunctionSupported(FunctionReflection $functionReflection): bool
 	{
 		return $functionReflection->getName() === 'curl_init';
@@ -26,10 +41,49 @@ public function getTypeFromFunctionCall(
 		Scope $scope,
 	): Type
 	{
-		$argsCount = count($functionCall->getArgs());
+		$args = $functionCall->getArgs();
+		$argsCount = count($args);
 		$returnType = ParametersAcceptorSelector::selectSingle($functionReflection->getVariants())->getReturnType();
+		$notFalseReturnType = TypeCombinator::remove($returnType, new ConstantBooleanType(false));
 		if ($argsCount === 0) {
-			return TypeCombinator::remove($returnType, new ConstantBooleanType(false));
+			return $notFalseReturnType;
+		}
+
+		$urlArgType = $scope->getType($args[0]->value);
+		if ($urlArgType->isNull()->yes()) {
+			return $notFalseReturnType;
+		}
+		if ($urlArgType->isString()->yes()) {
+			$urlArgValue = $urlArgType->getConstantScalarValues()[0] ?? null;
+			if ($urlArgValue !== null) {
+				if (!is_string($urlArgValue)) {
+					throw new ShouldNotHappenException();
+				}
+				if (str_contains($urlArgValue, "\0")) {
+					if (!$this->phpVersion->throwsValueErrorForInternalFunctions()) {
+						// https://github.com/php/php-src/blob/php-7.4.33/ext/curl/interface.c#L112-L115
+						return new ConstantBooleanType(false);
+					}
+					// https://github.com/php/php-src/blob/php-8.0.0/ext/curl/interface.c#L104-L107
+					return new NeverType();
+				}
+				if ($this->phpVersion->getVersionId() < 80000) {
+					// Before PHP 8.0 an unparsable URL or a file:// scheme would fail if open_basedir is used
+					// Since we can't detect open_basedir properly, we'll always consider a failure possible if these
+					//   conditions are given
+					// https://github.com/php/php-src/blob/php-7.4.33/ext/curl/interface.c#L139-L158
+					$parsedUrlArg = parse_url($urlArgValue);
+					if ($parsedUrlArg === false || (isset($parsedUrlArg['scheme']) && strcasecmp($parsedUrlArg['scheme'], 'file') === 0)) {
+						return $returnType;
+					}
+				}
+				if (strlen($urlArgValue) > self::CURL_MAX_INPUT_LENGTH) {
+					// Since libcurl 7.65.0 this would always fail, but no current PHP version requires it at the moment
+					// https://github.com/curl/curl/commit/5fc28510a4664f46459d9a40187d81cc08571e60
+					return $returnType;
+				}
+				return $notFalseReturnType;
+			}
 		}
 
 		return $returnType;

tests/PHPStan/Analyser/LegacyNodeScopeResolverTest.php

@@ -3087,6 +3087,42 @@ public function dataBinaryOperations(): array
 				PHP_VERSION_ID < 80000 ? 'resource|false' : 'CurlHandle|false',
 				'curl_init($string)',
 			],
+			[
+				PHP_VERSION_ID < 80000 ? 'resource' : 'CurlHandle',
+				'curl_init(null)',
+			],
+			[
+				PHP_VERSION_ID < 80000 ? 'resource' : 'CurlHandle',
+				'curl_init(\'https://phpstan.org\')',
+			],
+			[
+				PHP_VERSION_ID < 80000 ? 'false' : '*NEVER*',
+				"curl_init('\0')",
+			],
+			[
+				PHP_VERSION_ID < 80000 ? 'false' : '*NEVER*',
+				"curl_init('https://phpstan.org\0')",
+			],
+			[
+				PHP_VERSION_ID < 80000 ? 'resource' : 'CurlHandle',
+				'curl_init(\'\')',
+			],
+			[
+				PHP_VERSION_ID < 80000 ? 'resource|false' : 'CurlHandle',
+				'curl_init(\':\')',
+			],
+			[
+				PHP_VERSION_ID < 80000 ? 'resource|false' : 'CurlHandle',
+				'curl_init(\'file://host/text.txt\')',
+			],
+			[
+				PHP_VERSION_ID < 80000 ? 'resource|false' : 'CurlHandle',
+				'curl_init(\'FIle://host/text.txt\')',
+			],
+			[
+				PHP_VERSION_ID < 80000 ? 'resource' : 'CurlHandle',
+				'curl_init(\'host/text.txt\')',
+			],
 			[
 				'string',
 				'sprintf($string, $string, 1)',