SensitiveParameterValue is generic in its wrapped valuenew SensitiveParameterValue('secret') is SensitiveParameterValue<string>,
so getValue() is string. Tools that leave the class untemplated type
getValue() as mixed.
Source: phpstan/phpstan-src#6272 (2.2.10).
References:
- phpstan-src#6272
- PHP SensitiveParameterValue::getValue()| Analyzer | Version | Result | Diagnostics |
|---|---|---|---|
| phan | 6.0.11Phan 6.0.11 php-ast version 1.1.3 PHP version used to run Phan: 8.5.11 | Pass | No diagnostics reported. |
| phpstan | 2.3.5PHPStan - PHP Static Analysis Tool 2.3.5 | Pass reported Lv.5+ | generics_sensitive_parameter_value_inference.php:31: Parameter #1 $value of function Conformance\Tests\GenericsSensitiveParameterValueInference\takesInt expects int, string given. [reported-from-level=5] generics_sensitive_parameter_value_inference.php:35: Parameter #1 $value of function Conformance\Tests\GenericsSensitiveParameterValueInference\takesString expects string, int given. [reported-from-level=5] With strict-rulesgenerics_sensitive_parameter_value_inference.php:31: Parameter #1 $value of function Conformance\Tests\GenericsSensitiveParameterValueInference\takesInt expects int, string given. generics_sensitive_parameter_value_inference.php:35: Parameter #1 $value of function Conformance\Tests\GenericsSensitiveParameterValueInference\takesString expects string, int given. |
| psalm | 6.20.9Psalm 6.20.9@f67170ac3c3b931f5088681e21d6c8babc601c08 next: 7.0.4 |
Pass | generics_sensitive_parameter_value_inference.php:31: Argument 1 of Conformance\Tests\GenericsSensitiveParameterValueInference\takesInt expects int, but 'secret' provided [InvalidScalarArgument] generics_sensitive_parameter_value_inference.php:35: Argument 1 of Conformance\Tests\GenericsSensitiveParameterValueInference\takesString expects string, but 1 provided [InvalidScalarArgument] |
| mago | 1.59.0mago 1.59.0 | Fail | generics_sensitive_parameter_value_inference.php:30: Invalid argument type for argument #1 of `Conformance\Tests\GenericsSensitiveParameterValueInference\takesString`: expected `string`, but found `mixed`. [mixed-argument] generics_sensitive_parameter_value_inference.php:31: Invalid argument type for argument #1 of `Conformance\Tests\GenericsSensitiveParameterValueInference\takesInt`: expected `int`, but found `mixed`. [mixed-argument] generics_sensitive_parameter_value_inference.php:34: Invalid argument type for argument #1 of `Conformance\Tests\GenericsSensitiveParameterValueInference\takesInt`: expected `int`, but found `mixed`. [mixed-argument] generics_sensitive_parameter_value_inference.php:35: Invalid argument type for argument #1 of `Conformance\Tests\GenericsSensitiveParameterValueInference\takesString`: expected `string`, but found `mixed`. [mixed-argument] Expectation diffLine 30: Expected valid value to be accepted, got ["Invalid argument type for argument #1 of `Conformance\\Tests\\GenericsSensitiveParameterValueInference\\takesString`: expected `string`, but found `mixed`. [mixed-argument]"] Line 34: Expected valid value to be accepted, got ["Invalid argument type for argument #1 of `Conformance\\Tests\\GenericsSensitiveParameterValueInference\\takesInt`: expected `int`, but found `mixed`. [mixed-argument]"] |
| mir | 0.91.0mir 0.91.0 | Fail | generics_sensitive_parameter_value_inference.php:30: MixedArgument: Argument $value of takesString() is mixed [MIR1200] generics_sensitive_parameter_value_inference.php:31: MixedArgument: Argument $value of takesInt() is mixed [MIR1200] generics_sensitive_parameter_value_inference.php:34: MixedArgument: Argument $value of takesInt() is mixed [MIR1200] generics_sensitive_parameter_value_inference.php:35: MixedArgument: Argument $value of takesString() is mixed [MIR1200] Expectation diffLine 30: Expected valid value to be accepted, got ["MixedArgument: Argument $value of takesString() is mixed [MIR1200]"] Line 34: Expected valid value to be accepted, got ["MixedArgument: Argument $value of takesInt() is mixed [MIR1200]"] |
| phpantom | 0.11.1phpantom_lsp 0.11.1 | Pass | No diagnostics reported. |
| intelephense | 1.18.5intelephense 1.18.5 | Fail | generics_sensitive_parameter_value_inference.php:30: Expected type 'string'. Found 'mixed'. [P1006] generics_sensitive_parameter_value_inference.php:31: Expected type 'int'. Found 'mixed'. [P1006] generics_sensitive_parameter_value_inference.php:34: Expected type 'int'. Found 'mixed'. [P1006] generics_sensitive_parameter_value_inference.php:35: Expected type 'string'. Found 'mixed'. [P1006] Expectation diffLine 30: Expected valid value to be accepted, got ["Expected type 'string'. Found 'mixed'. [P1006]"] Line 34: Expected valid value to be accepted, got ["Expected type 'int'. Found 'mixed'. [P1006]"] |
| phpactor | 2026.10.07.0Phpactor 2026.10.07.0 | Pass | No diagnostics reported. |
| phpy | 1.0.19490phpy 1.0.19490 | Pass | No diagnostics reported. |
| qodana | 262.11879.104PhpStorm 262.11879.104 | Pass | No diagnostics reported. |
| noverify | 0.5.5NoVerify, version 0.5.5: built on: 2025.04.22 14:36:46 OS: r-kuchinskas arm64 Commit: 4774b82f8adc53fbef38f95e97af4b953b4d1529 | Fail | generics_sensitive_parameter_value_inference.php:29: Class or interface named \SensitiveParameterValue does not exist [undefinedClass]
generics_sensitive_parameter_value_inference.php:30: Call to undefined method {\SensitiveParameterValue}->getValue() [undefinedMethod]
generics_sensitive_parameter_value_inference.php:31: Call to undefined method {\SensitiveParameterValue}->getValue() [undefinedMethod]
generics_sensitive_parameter_value_inference.php:33: Class or interface named \SensitiveParameterValue does not exist [undefinedClass]
generics_sensitive_parameter_value_inference.php:34: Call to undefined method {\SensitiveParameterValue}->getValue() [undefinedMethod]
generics_sensitive_parameter_value_inference.php:35: Call to undefined method {\SensitiveParameterValue}->getValue() [undefinedMethod]Expectation diffLine 30: Expected valid value to be accepted, got ["Call to undefined method {\\SensitiveParameterValue}->getValue() [undefinedMethod]"]
Line 34: Expected valid value to be accepted, got ["Call to undefined method {\\SensitiveParameterValue}->getValue() [undefinedMethod]"]
Line 29: Unexpected errors ["Class or interface named \\SensitiveParameterValue does not exist [undefinedClass]"]
Line 33: Unexpected errors ["Class or interface named \\SensitiveParameterValue does not exist [undefinedClass]"] |
| steins | 0.1.8steins 0.1.8 (2026-09-21 revision 76306a9) | Pass | No diagnostics reported. |
| phpstan-strict | 2.3.5PHPStan - PHP Static Analysis Tool 2.3.5 | Pass | generics_sensitive_parameter_value_inference.php:31: Parameter #1 $value of function Conformance\Tests\GenericsSensitiveParameterValueInference\takesInt expects int, string given. generics_sensitive_parameter_value_inference.php:35: Parameter #1 $value of function Conformance\Tests\GenericsSensitiveParameterValueInference\takesString expects string, int given. |
| psalm-next | 7.0.4Psalm 7.0.4@fa5b1f6e665cb743838ffd865b8fc96207f9409f | Pass | generics_sensitive_parameter_value_inference.php:31: Argument 1 of Conformance\Tests\GenericsSensitiveParameterValueInference\takesInt expects int, but 'secret' provided [InvalidScalarArgument] generics_sensitive_parameter_value_inference.php:35: Argument 1 of Conformance\Tests\GenericsSensitiveParameterValueInference\takesString expects string, but 1 provided [InvalidScalarArgument] |
<?php
declare(strict_types=1);
namespace Conformance\Tests\GenericsSensitiveParameterValueInference;
/**
* `SensitiveParameterValue` is generic in its wrapped value.
*
* `new SensitiveParameterValue('secret')` is `SensitiveParameterValue<string>`,
* so `getValue()` is `string`. Tools that leave the class untemplated type
* `getValue()` as `mixed`.
*
* Source: phpstan/phpstan-src#6272 (2.2.10).
*
* References:
* - https://github.com/phpstan/phpstan-src/pull/6272
* - PHP `SensitiveParameterValue::getValue()`
*/
function takesString(string $value): void
{
}
function takesInt(int $value): void
{
}
$wrapped = new \SensitiveParameterValue('secret');
takesString($wrapped->getValue()); // V: constructor argument pins T to string
takesInt($wrapped->getValue()); // E?: getValue() is string, not int
$intWrapped = new \SensitiveParameterValue(1);
takesInt($intWrapped->getValue()); // V
takesString($intWrapped->getValue()); // E?: getValue() is int, not string