Potential risky return of array<string, …>

[nickvergessen]

If APIs return array<string, …> it is very likely that they are misbehaving on JSON.

Ref nextcloud/spreed#10832

problem is that arrays are used for dictionaries and lists

Sample

<?php

$a = ['a' => true];
$b = [true];


var_dump($a, $b);
var_dump(json_encode($a), json_encode($b));

unset($a['a']);
unset($b[0]);

var_dump($a, $b);

var_dump(json_encode($a), json_encode($b));

Result

array(1) {
  ["a"]=>
  bool(true)
}
array(1) {
  [0]=>
  bool(true)
}
string(10) "{"a":true}"
string(6) "[true]"
array(0) {
}
array(0) {
}
string(2) "[]" // 💔 JSON consumers would expect `"{}"` here
string(2) "[]"

Idea

We can help developers and signal: if you return array<string, …> you are mostlikely running into this error when your array is empty. The fixed return should be array<string, …>|\stdClass like in the Talk PR.

[provokateurin]

In the error message we shouldn't only tell the developer what they need to change but also why. Psalm will start complaining but they might not understand why without any further information.

[provokateurin]

To quote from #172:

Enforce array<key, value> to be array<key, value>|\stdClass to account for empty arrays

An exception to this is the use of non-empty-array<key, value>, since we know this problem can't appear there.