Do not resolve include paths through a stream wrapper that is not registered (#6397)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ondrejmirtes

src/File/IncludedFilePathResolver.php

@@ -10,6 +10,10 @@
 use function dirname;
 use function explode;
 use function get_include_path;
+use function in_array;
+use function preg_match;
+use function stream_get_wrappers;
+use function strtolower;
 use const PATH_SEPARATOR;
 
 /**
@@ -34,6 +38,10 @@ public function __construct(
 	 */
 	public function resolve(string $path, Scope $scope): array
 	{
+		if ($this->hasUnavailableStreamWrapper($path)) {
+			return [];
+		}
+
 		$directories = array_merge(
 			[$this->currentWorkingDirectory],
 			explode(PATH_SEPARATOR, get_include_path()),
@@ -53,6 +61,23 @@ public function resolve(string $path, Scope $scope): array
 		return array_values($candidatePaths);
 	}
 
+	/**
+	 * A path like `vfs://sites/default/x.php` names a stream wrapper rather than a place on the
+	 * filesystem. When that wrapper is not registered in the PHPStan process - vfsStream registers
+	 * its own from a test's setUp(), which never runs here - PHP cannot stat the path at all: every
+	 * is_file() on it raises "Unable to find the wrapper". Such a path has no candidates, and it
+	 * cannot come to have any, so nothing downstream should keep stat'ing it - the result cache
+	 * would otherwise record it as a missing file dependency and warn on every run.
+	 */
+	private function hasUnavailableStreamWrapper(string $path): bool
+	{
+		if (preg_match('~^([a-z0-9+\-.]+)://~i', $path, $matches) !== 1) {
+			return false;
+		}
+
+		return !in_array(strtolower($matches[1]), stream_get_wrappers(), true);
+	}
+
 	/**
 	 * Both `__DIR__` and the "calling script's own directory" fallback of a relative include are
 	 * resolved at compile time, so inside a trait they point at the file the trait is declared in - not

tests/PHPStan/File/IncludedFilePathResolverTest.php

@@ -0,0 +1,54 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\File;
+
+use PHPStan\Analyser\Scope;
+use PHPStan\Testing\PHPStanTestCase;
+use function array_map;
+use function str_replace;
+
+final class IncludedFilePathResolverTest extends PHPStanTestCase
+{
+
+	private function createResolver(): IncludedFilePathResolver
+	{
+		return new IncludedFilePathResolver(__DIR__, self::getContainer()->getByType(FileHelper::class));
+	}
+
+	private function createScope(): Scope
+	{
+		$scope = $this->createMock(Scope::class);
+		$scope->method('isInTrait')->willReturn(false);
+		$scope->method('getFile')->willReturn(__DIR__ . '/test/lorem.php');
+
+		return $scope;
+	}
+
+	public function testPathWithAnUnregisteredStreamWrapperHasNoCandidates(): void
+	{
+		// is_file() on it raises "Unable to find the wrapper" instead of answering, and the path
+		// cannot become readable later either - vfsStream registers its wrapper from a test's
+		// setUp(), which never runs inside PHPStan.
+		$this->assertSame([], $this->createResolver()->resolve('vfs://drupal/sites/default/x.php', $this->createScope()));
+	}
+
+	public function testPathWithARegisteredStreamWrapperIsKept(): void
+	{
+		$this->assertSame(['php://memory'], $this->createResolver()->resolve('php://memory', $this->createScope()));
+	}
+
+	public function testRelativePathIsResolvedAgainstEveryDirectory(): void
+	{
+		// Compared with forward slashes so the expectations hold on Windows too, where
+		// absolutizePath() joins with a backslash.
+		$paths = array_map(
+			static fn (string $path): string => str_replace('\\', '/', $path),
+			$this->createResolver()->resolve('lorem.php', $this->createScope()),
+		);
+		$directory = str_replace('\\', '/', __DIR__);
+
+		$this->assertContains($directory . '/lorem.php', $paths);
+		$this->assertContains($directory . '/test/lorem.php', $paths);
+	}
+
+}

tests/PHPStan/Rules/Keywords/RequireFileExistsRuleTest.php

@@ -41,6 +41,22 @@ public static function getAdditionalConfigFiles(): array
 		];
 	}
 
+	public function testPathWithAnUnregisteredStreamWrapper(): void
+	{
+		// PHPStan cannot see through a wrapper that is not registered, so the path is still
+		// reported - it just must not be stat'd to get there, see IncludedFilePathResolverTest.
+		$this->analyse([__DIR__ . '/data/require-file-stream-wrapper.php'], [
+			[
+				'Path in include_once() "vfs://drupal/sites/default/modules/module_a/module_a.post_update.php" is not a file or it does not exist.',
+				7,
+			],
+			[
+				'Path in require() "not-a-registered-wrapper://somewhere/else.php" is not a file or it does not exist.',
+				8,
+			],
+		]);
+	}
+
 	public function testBasicCase(): void
 	{
 		$this->analyse([__DIR__ . '/data/require-file-simple-case.php'], [

tests/PHPStan/Rules/Keywords/data/require-file-stream-wrapper.php

@@ -0,0 +1,8 @@
+<?php declare(strict_types = 1);
+
+namespace RequireFileStreamWrapper;
+
+// vfsStream registers the "vfs" wrapper from a test's setUp(), so it is not registered while
+// PHPStan runs and is_file() on the path cannot answer - it raises a warning instead.
+include_once 'vfs://drupal/sites/default/modules/module_a/module_a.post_update.php';
+require 'not-a-registered-wrapper://somewhere/else.php';