Report non-stringable names in variable variables, dynamic method cal…

…ls and dynamic static property/method access - Extract the existing inline `checkNonStringableDynamicAccess` logic from `AccessPropertiesCheck` and `ClassConstantRule` into a shared `NonStringableDynamicAccessCheck` service with two entry points: `checkStringCastableName()` (objects with `__toString` accepted) and `checkStringName()` (real strings only). - `DefinedVariableRule`: report `$$expr` when the name is not stringable (e.g. `$$this`), the case from the issue (identifier `variable.nameNotString`). - `CallMethodsRule` / `CallStaticMethodsRule`: report `$obj->{$expr}()` / `Foo::{$expr}()` when the name is not a string; method names do not accept `Stringable` (identifiers `method.nameNotString`, `staticMethod.nameNotString`). - `AccessStaticPropertiesCheck`: report `Foo::${$expr}` when the name is not stringable, gated on read access to avoid double-reporting on assignment (identifier `staticProperty.nameNotString`). - All checks remain behind the `checkNonStringableDynamicAccess` feature toggle (bleeding edge), matching the pre-existing property and class-constant checks. - Property and class-constant checks now delegate to the shared service; behavior and messages are unchanged.
ondrejmirtes · Sep 20, 2026 · Jun 14, 2026 · Jun 14, 2026 · Jun 14, 2026 · Jun 14, 2026
commit dd8aa7f8bafdb737e9a6a6bb3d37f4107c2af69a
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
@@ -228,12 +228,24 @@ parameters:
 			count: 1
 			path: src/DependencyInjection/ContainerFactory.php
 
+		-
+			rawMessage: 'Method name for Nette\Schema\Elements\AnyOf|Nette\Schema\Elements\Structure|Nette\Schema\Elements\Type must be a string, but array|Nette\DI\Definitions\Definition|Nette\DI\Definitions\Reference|string|null was given.'
+			identifier: method.nameNotString
+			count: 1
+			path: src/DependencyInjection/ContainerFactory.php
+
 		-
 			rawMessage: Variable static method call on Nette\Schema\Expect.
 			identifier: staticMethod.dynamicName
 			count: 1
 			path: src/DependencyInjection/ContainerFactory.php
 
+		-
+			rawMessage: 'Method name for Nette\Schema\Expect must be a string, but array|Nette\DI\Definitions\Definition|Nette\DI\Definitions\Reference|string|null was given.'
+			identifier: staticMethod.nameNotString
+			count: 1
+			path: src/DependencyInjection/ContainerFactory.php
+
 		-
 			rawMessage: Fetching class constant PREVENT_MERGING of deprecated class Nette\DI\Config\Helpers.
 			identifier: classConstant.deprecatedClass

diff --git a/src/Rules/Classes/ClassConstantRule.php b/src/Rules/Classes/ClassConstantRule.php
@@ -9,7 +9,6 @@
 use PhpParser\Node\Scalar\String_;
 use PHPStan\Analyser\NullsafeOperatorHelper;
 use PHPStan\Analyser\Scope;
-use PHPStan\DependencyInjection\AutowiredParameter;
 use PHPStan\DependencyInjection\RegisteredRule;
 use PHPStan\Internal\SprintfHelper;
 use PHPStan\Php\PhpVersion;
@@ -18,6 +17,7 @@
 use PHPStan\Rules\ClassNameNodePair;
 use PHPStan\Rules\ClassNameUsageLocation;
 use PHPStan\Rules\IdentifierRuleError;
+use PHPStan\Rules\NonStringableDynamicAccessCheck;
 use PHPStan\Rules\Rule;
 use PHPStan\Rules\RuleErrorBuilder;
 use PHPStan\Rules\RuleLevelHelper;
@@ -44,8 +44,7 @@ public function __construct(
 		private RuleLevelHelper $ruleLevelHelper,
 		private ClassNameCheck $classCheck,
 		private PhpVersion $phpVersion,
-		#[AutowiredParameter(ref: '%featureToggles.checkNonStringableDynamicAccess%')]
-		private bool $checkNonStringableDynamicAccess,
+		private NonStringableDynamicAccessCheck $nonStringableDynamicAccessCheck,
 	)
 	{
 	}
@@ -68,24 +67,15 @@ public function processNode(Node $node, Scope $scope): array
 				$constantNameScopes[$name] = $scope->filterByTruthyValue(new Identical($node->name, new String_($name)));
 			}
 
-			if ($this->checkNonStringableDynamicAccess) {
-				$nameTypeResult = $this->ruleLevelHelper->findTypeToCheck(
-					$scope,
-					$node->name,
-					'',
-					static fn (Type $type) => $type->isString()->yes(),
-				);
+			$nonStringableNameType = $this->nonStringableDynamicAccessCheck->checkStringName($scope, $node->name);
+			if ($nonStringableNameType !== null) {
+				$className = $node->class instanceof Name
+					? $scope->resolveName($node->class)
+					: $scope->getType($node->class)->describe(VerbosityLevel::typeOnly());
 
-				$nameType = $nameTypeResult->getType();
-				if (!$nameType instanceof ErrorType && !$nameType->isString()->yes()) {
-					$className = $node->class instanceof Name
-						? $scope->resolveName($node->class)
-						: $scope->getType($node->class)->describe(VerbosityLevel::typeOnly());
-
-					$errors[] = RuleErrorBuilder::message(sprintf('Class constant name for %s must be a string, but %s was given.', $className, $nameType->describe(VerbosityLevel::precise())))
-						->identifier('classConstant.nameNotString')
-						->build();
-				}
+				$errors[] = RuleErrorBuilder::message(sprintf('Class constant name for %s must be a string, but %s was given.', $className, $nonStringableNameType->describe(VerbosityLevel::precise())))
+					->identifier('classConstant.nameNotString')
+					->build();
 			}
 		}
 

diff --git a/src/Rules/Methods/CallMethodsRule.php b/src/Rules/Methods/CallMethodsRule.php
@@ -14,8 +14,12 @@
 use PHPStan\Reflection\ParametersAcceptorSelector;
 use PHPStan\Rules\FunctionCallParametersCheck;
 use PHPStan\Rules\IdentifierRuleError;
+use PHPStan\Rules\NonStringableDynamicAccessCheck;
 use PHPStan\Rules\Rule;
+use PHPStan\Rules\RuleErrorBuilder;
+use PHPStan\Type\VerbosityLevel;
 use function array_merge;
+use function sprintf;
 
 /**
  * @implements Rule<Node\Expr\MethodCall>
@@ -27,6 +31,7 @@ final class CallMethodsRule implements Rule
 	public function __construct(
 		private MethodCallCheck $methodCallCheck,
 		private FunctionCallParametersCheck $parametersCheck,
+		private NonStringableDynamicAccessCheck $nonStringableDynamicAccessCheck,
 	)
 	{
 	}
@@ -48,6 +53,18 @@ public function processNode(Node $node, Scope&NodeCallbackInvoker&CollectedDataE
 				$name = $constantString->getValue();
 				$methodNameScopes[$name] = $scope->filterByTruthyValue(new Identical($node->name, new String_($name)));
 			}
+
+			$nonStringableNameType = $this->nonStringableDynamicAccessCheck->checkStringName($scope, $node->name);
+			if ($nonStringableNameType !== null) {
+				$errors[] = RuleErrorBuilder::message(sprintf(
+					'Method name for %s must be a string, but %s was given.',
+					$scope->getType($node->var)->describe(VerbosityLevel::typeOnly()),
+					$nonStringableNameType->describe(VerbosityLevel::precise()),
+				))
+					->line($node->name->getStartLine())
+					->identifier('method.nameNotString')
+					->build();
+			}
 		}
 
 		foreach ($methodNameScopes as $methodName => $methodScope) {

diff --git a/src/Rules/Methods/CallStaticMethodsRule.php b/src/Rules/Methods/CallStaticMethodsRule.php
@@ -5,6 +5,7 @@
 use PhpParser\Node;
 use PhpParser\Node\Expr\BinaryOp\Identical;
 use PhpParser\Node\Expr\StaticCall;
+use PhpParser\Node\Name;
 use PhpParser\Node\Scalar\String_;
 use PHPStan\Analyser\CollectedDataEmitter;
 use PHPStan\Analyser\NodeCallbackInvoker;
@@ -14,7 +15,10 @@
 use PHPStan\Reflection\ParametersAcceptorSelector;
 use PHPStan\Rules\FunctionCallParametersCheck;
 use PHPStan\Rules\IdentifierRuleError;
+use PHPStan\Rules\NonStringableDynamicAccessCheck;
 use PHPStan\Rules\Rule;
+use PHPStan\Rules\RuleErrorBuilder;
+use PHPStan\Type\VerbosityLevel;
 use function array_merge;
 use function sprintf;
 
@@ -28,6 +32,7 @@ final class CallStaticMethodsRule implements Rule
 	public function __construct(
 		private StaticMethodCallCheck $methodCallCheck,
 		private FunctionCallParametersCheck $parametersCheck,
+		private NonStringableDynamicAccessCheck $nonStringableDynamicAccessCheck,
 	)
 	{
 	}
@@ -49,6 +54,22 @@ public function processNode(Node $node, Scope&NodeCallbackInvoker&CollectedDataE
 				$name = $constantString->getValue();
 				$methodNameScopes[$name] = $scope->filterByTruthyValue(new Identical($node->name, new String_($name)));
 			}
+
+			$nonStringableNameType = $this->nonStringableDynamicAccessCheck->checkStringName($scope, $node->name);
+			if ($nonStringableNameType !== null) {
+				$className = $node->class instanceof Name
+					? $scope->resolveName($node->class)
+					: $scope->getType($node->class)->describe(VerbosityLevel::typeOnly());
+
+				$errors[] = RuleErrorBuilder::message(sprintf(
+					'Method name for %s must be a string, but %s was given.',
+					$className,
+					$nonStringableNameType->describe(VerbosityLevel::precise()),
+				))
+					->line($node->name->getStartLine())
+					->identifier('staticMethod.nameNotString')
+					->build();
+			}
 		}
 
 		foreach ($methodNameScopes as $methodName => $methodScope) {

diff --git a/src/Rules/NonStringableDynamicAccessCheck.php b/src/Rules/NonStringableDynamicAccessCheck.php
@@ -0,0 +1,85 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Rules;
+
+use PhpParser\Node\Expr;
+use PHPStan\Analyser\Scope;
+use PHPStan\DependencyInjection\AutowiredParameter;
+use PHPStan\DependencyInjection\AutowiredService;
+use PHPStan\Type\ErrorType;
+use PHPStan\Type\Type;
+
+/**
+ * Checks whether the name of a dynamically accessed variable or member
+ * (`$$name`, `$obj->{$name}`, `$obj->{$name}()`, `Foo::{$name}()`,
+ * `Foo::${$name}`, `Foo::{$name}`) can actually be used as a name at runtime.
+ *
+ * Gated behind the `checkNonStringableDynamicAccess` feature toggle.
+ */
+#[AutowiredService]
+final class NonStringableDynamicAccessCheck
+{
+
+	public function __construct(
+		private RuleLevelHelper $ruleLevelHelper,
+		#[AutowiredParameter(ref: '%featureToggles.checkNonStringableDynamicAccess%')]
+		private bool $checkNonStringableDynamicAccess,
+	)
+	{
+	}
+
+	/**
+	 * For names that PHP casts to string at runtime (variable variables,
+	 * property and static property names) objects implementing __toString are
+	 * accepted. Returns the offending name type to report, or null when the
+	 * name is usable.
+	 */
+	public function checkStringCastableName(Scope $scope, Expr $name): ?Type
+	{
+		if (!$this->checkNonStringableDynamicAccess) {
+			return null;
+		}
+
+		$nameType = $this->ruleLevelHelper->findTypeToCheck(
+			$scope,
+			$name,
+			'',
+			static fn (Type $type) => !$type->toString() instanceof ErrorType && $type->toString()->isString()->yes(),
+		)->getType();
+
+		if (
+			!$nameType instanceof ErrorType
+			&& ($nameType->toString() instanceof ErrorType || !$nameType->toString()->isString()->yes())
+		) {
+			return $scope->getType($name);
+		}
+
+		return null;
+	}
+
+	/**
+	 * For names that must be actual strings (method, static method and class
+	 * constant names) objects implementing __toString are not accepted.
+	 * Returns the offending name type to report, or null when the name is usable.
+	 */
+	public function checkStringName(Scope $scope, Expr $name): ?Type
+	{
+		if (!$this->checkNonStringableDynamicAccess) {
+			return null;
+		}
+
+		$nameType = $this->ruleLevelHelper->findTypeToCheck(
+			$scope,
+			$name,
+			'',
+			static fn (Type $type) => $type->isString()->yes(),
+		)->getType();
+
+		if (!$nameType instanceof ErrorType && !$nameType->isString()->yes()) {
+			return $nameType;
+		}
+
+		return null;
+	}
+
+}
diff --git a/src/Rules/Properties/AccessPropertiesCheck.php b/src/Rules/Properties/AccessPropertiesCheck.php
@@ -18,6 +18,7 @@
 use PHPStan\Reflection\MissingPropertyFromReflectionException;
 use PHPStan\Reflection\ReflectionProvider;
 use PHPStan\Rules\IdentifierRuleError;
+use PHPStan\Rules\NonStringableDynamicAccessCheck;
 use PHPStan\Rules\RuleErrorBuilder;
 use PHPStan\Rules\RuleLevelHelper;
 use PHPStan\Type\Constant\ConstantStringType;
@@ -39,12 +40,11 @@ public function __construct(
 		private ReflectionProvider $reflectionProvider,
 		private RuleLevelHelper $ruleLevelHelper,
 		private PhpVersion $phpVersion,
+		private NonStringableDynamicAccessCheck $nonStringableDynamicAccessCheck,
 		#[AutowiredParameter]
 		private bool $reportMagicProperties,
 		#[AutowiredParameter]
 		private bool $checkDynamicProperties,
-		#[AutowiredParameter(ref: '%featureToggles.checkNonStringableDynamicAccess%')]
-		private bool $checkNonStringableDynamicAccess,
 	)
 	{
 	}
@@ -60,24 +60,11 @@ public function check(PropertyFetch $node, Scope $scope, bool $write): array
 		} else {
 			$names = array_map(static fn (ConstantStringType $type): string => $type->getValue(), $scope->getType($node->name)->getConstantStrings());
 
-			if (!$write && $this->checkNonStringableDynamicAccess) {
-				$nameTypeResult = $this->ruleLevelHelper->findTypeToCheck(
-					$scope,
-					$node->name,
-					'',
-					static fn (Type $type) => !$type->toString() instanceof ErrorType && $type->toString()->isString()->yes(),
-				);
-				$nameType = $nameTypeResult->getType();
-				if (
-					!$nameType instanceof ErrorType
-					&& (
-						$nameType->toString() instanceof ErrorType
-						|| !$nameType->toString()->isString()->yes()
-					)
-				) {
-					$originalNameType = $scope->getType($node->name);
+			if (!$write) {
+				$nonStringableNameType = $this->nonStringableDynamicAccessCheck->checkStringCastableName($scope, $node->name);
+				if ($nonStringableNameType !== null) {
 					$className = $scope->getType($node->var)->describe(VerbosityLevel::typeOnly());
-					$errors[] = RuleErrorBuilder::message(sprintf('Property name for %s must be a string, but %s was given.', $className, $originalNameType->describe(VerbosityLevel::precise())))
+					$errors[] = RuleErrorBuilder::message(sprintf('Property name for %s must be a string, but %s was given.', $className, $nonStringableNameType->describe(VerbosityLevel::precise())))
 						->line($node->name->getStartLine())
 						->identifier('property.nameNotString')
 						->build();

diff --git a/src/Rules/Properties/AccessStaticPropertiesCheck.php b/src/Rules/Properties/AccessStaticPropertiesCheck.php
@@ -22,6 +22,7 @@
 use PHPStan\Rules\ClassNameNodePair;
 use PHPStan\Rules\ClassNameUsageLocation;
 use PHPStan\Rules\IdentifierRuleError;
+use PHPStan\Rules\NonStringableDynamicAccessCheck;
 use PHPStan\Rules\RuleErrorBuilder;
 use PHPStan\Rules\RuleLevelHelper;
 use PHPStan\Type\Constant\ConstantStringType;
@@ -48,6 +49,7 @@ public function __construct(
 		private RuleLevelHelper $ruleLevelHelper,
 		private ClassNameCheck $classCheck,
 		private PhpVersion $phpVersion,
+		private NonStringableDynamicAccessCheck $nonStringableDynamicAccessCheck,
 		#[AutowiredParameter(ref: '%tips.discoveringSymbols%')]
 		private bool $discoveringSymbolsTip,
 	)
@@ -59,13 +61,29 @@ public function __construct(
 	 */
 	public function check(StaticPropertyFetch $node, Scope $scope, bool $write): array
 	{
+		$errors = [];
 		if ($node->name instanceof Node\VarLikeIdentifier) {
 			$names = [$node->name->name];
 		} else {
 			$names = array_map(static fn (ConstantStringType $type): string => $type->getValue(), $scope->getType($node->name)->getConstantStrings());
+
+			$nonStringableNameType = $write ? null : $this->nonStringableDynamicAccessCheck->checkStringCastableName($scope, $node->name);
+			if ($nonStringableNameType !== null) {
+				$className = $node->class instanceof Name
+					? $scope->resolveName($node->class)
+					: $scope->getType($node->class)->describe(VerbosityLevel::typeOnly());
+
+				$errors[] = RuleErrorBuilder::message(sprintf(
+					'Static property name for %s must be a string, but %s was given.',
+					$className,
+					$nonStringableNameType->describe(VerbosityLevel::precise()),
+				))
+					->line($node->name->getStartLine())
+					->identifier('staticProperty.nameNotString')
+					->build();
+			}
 		}
 
-		$errors = [];
 		foreach ($names as $name) {
 			$errors = array_merge($errors, $this->processSingleProperty($scope, $node, $name, $write));
 		}

diff --git a/src/Rules/Variables/DefinedVariableRule.php b/src/Rules/Variables/DefinedVariableRule.php
@@ -10,8 +10,10 @@
 use PHPStan\DependencyInjection\AutowiredParameter;
 use PHPStan\DependencyInjection\RegisteredRule;
 use PHPStan\Rules\IdentifierRuleError;
+use PHPStan\Rules\NonStringableDynamicAccessCheck;
 use PHPStan\Rules\Rule;
 use PHPStan\Rules\RuleErrorBuilder;
+use PHPStan\Type\VerbosityLevel;
 use function array_merge;
 use function in_array;
 use function is_string;
@@ -25,6 +27,7 @@ final class DefinedVariableRule implements Rule
 {
 
 	public function __construct(
+		private NonStringableDynamicAccessCheck $nonStringableDynamicAccessCheck,
 		#[AutowiredParameter]
 		private bool $cliArgumentsVariablesRegistered,
 		#[AutowiredParameter]
@@ -50,6 +53,16 @@ public function processNode(Node $node, Scope $scope): array
 				$name = $constantString->getValue();
 				$variableNameScopes[$name] = $scope->filterByTruthyValue(new Identical($node->name, new String_($name)));
 			}
+
+			$nonStringableNameType = $this->nonStringableDynamicAccessCheck->checkStringCastableName($scope, $node->name);
+			if ($nonStringableNameType !== null) {
+				$errors[] = RuleErrorBuilder::message(sprintf(
+					'Variable variable name must be a string, but %s was given.',
+					$nonStringableNameType->describe(VerbosityLevel::precise()),
+				))
+					->identifier('variable.nameNotString')
+					->build();
+			}
 		}
 
 		foreach ($variableNameScopes as $name => $variableScope) {