[lijun-chen-sonarsource]

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

---

Summary by Gitar

• Dynamic variable reads:
  • Treats $$name, ${'literal'}, and unresolved dynamic reads as reads of locals in ReadWriteUsages
  • Excludes write-only dynamic targets, static members, and direct string interpolation from dynamic read tracking
• Indirect local access:
  • Treats include, require, eval, extract, and get_defined_vars calls as reading all locals in their scope
• Tests:
  • Added UnusedLocalVariableCheckDynamicReads.php fixture covering dynamic read and write scenarios
• Static method names:
  • Tracks dynamic locals used as static method names, such as Example::$$name(), as reads

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARPHP-1969

[asya-vorobeva]

🔢

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
92.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Expanding dynamic-read tracking may suppress unused-local findings for unrelated variables, hiding genuine dead code from PHP analysis.

Adds dynamic local variable read tracking so $$name, ${'literal'}, and indirect access via include, eval, extract, and get_defined_vars count as reads in ReadWriteUsages. Static method calls with a variable-variable name, such as Example::$$name(), are now tracked as reads, addressing the skipped-read finding. No open issues found.

✅ 1 closed

✅ Edge Case: Static method calls with a variable-variable name are skipped as reads

📄 php-checks/src/main/java/org/sonar/php/checks/utils/ReadWriteUsages.java:142 📄 php-checks/src/main/java/org/sonar/php/checks/utils/ReadWriteUsages.java:150 📄 php-checks/src/main/java/org/sonar/php/checks/utils/ReadWriteUsages.java:183-185
isStaticMemberName treats every $$name or ${$name} that is the member of a static MemberAccessTree as a static property name. That is only true for property access. In Example::$$name() or Example::${$name}() (the grammar's CLASS_MEMBER_ACCESS with VARIABLE_WITHOUT_OBJECTS as the member, called through a FunctionCallTree), PHP evaluates the whole member expression as the method name. So $$name reads the local named by $name, the same way Example::$method() reads the local $method. These calls are therefore never passed to visitDynamicRead. For example, in function f($name) { $method = 'foo'; return Example::$$name(); } the rule still reports $method as unused, which is the false positive this PR is meant to remove. Fix: exclude only static members that are not the callee of a function call (or treat the call case as a dynamic read), and add a test case.

Verification Rules 1/1 met PRs 2 inspected

Functional validation No results

Rules 1 passed 2 not applicable

✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR #1854: SONARPHP-1593 Track reads through sibling and nested closure references Inspected
PR #1853: SONARPHP-1972 Exempt underscore-prefixed unused local variables Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}