Fix #13963 with unit tests.

src/Type/Php/FilterFunctionReturnTypeHelper.php

@@ -24,6 +24,7 @@
 use PHPStan\Type\MixedType;
 use PHPStan\Type\NeverType;
 use PHPStan\Type\NullType;
+use PHPStan\Type\ObjectShapeType;
 use PHPStan\Type\StringType;
 use PHPStan\Type\Type;
 use PHPStan\Type\TypeCombinator;
@@ -191,7 +192,11 @@
 			$type = TypeCombinator::intersect($type, $accessory);
 		}
 
-		if ($exactType === null || $hasOptions->maybe() || (!$inputType->equals($type) && $inputType->isSuperTypeOf($type)->yes())) {
+		if (
+			$exactType === null
+			|| $hasOptions->maybe()
+			|| ($this->isValidationFilter($filterValue) && (!$inputType->equals($type) && $inputType->isSuperTypeOf($type)->yes()))
+		) {
 			if (!$defaultType->isSuperTypeOf($type)->yes()) {
 				$type = TypeCombinator::union($type, $defaultType);
 			}
@@ -389,18 +394,70 @@
 		}
 
 		if ($filterValue === $this->getConstant('FILTER_DEFAULT')) {
-			if ($this->canStringBeSanitized($filterValue, $flagsType)->no() && $in->isString()->yes()) {
-				return $in;
+			$scalarOrNull = new UnionType([
+				new StringType(),
+				new FloatType(),
+				new BooleanType(),
+				new IntegerType(),
+				new NullType(),
+			]);
+
+			$scalarOrNullType = null;
+			$useDefaultType = false;
+
+			if ($scalarOrNull->isSuperTypeOf($in)->yes()) {
+				$scalarOrNullType = $in;
 			}
 
-			if ($in->isBoolean()->yes() || $in->isFloat()->yes() || $in->isInteger()->yes() || $in->isNull()->yes()) {
-				return $in->toString();
+			if ($scalarOrNull->isSuperTypeOf($in)->maybe()) {
+				// $in is (array or object) or (scalar or null).
+				$scalarOrNullType = TypeCombinator::remove(
+					TypeCombinator::remove($in, new ObjectShapeType([], [])),
+					new ArrayType(new MixedType(), new MixedType()),
+				);
+				// Combine future results with defaultType as $in might be an array or an object.
+				$useDefaultType = true;
+			}
+
+			if (
+				$scalarOrNullType !== null
+				&& ($in->isSuperTypeOf(new MixedType())->yes() || $scalarOrNull->isSuperTypeOf($scalarOrNullType)->yes())
+			) {
+				$canBeSanitized = $this->canStringBeSanitized($filterValue, $flagsType);
+				if ($canBeSanitized->no()) {
+					$stringType = $scalarOrNullType->toString();
+				} elseif ($scalarOrNullType->isString()->no()) {
+					$stringType = $scalarOrNullType->toString();
+				} else {
+					$stringType = TypeCombinator::union(
+						TypeCombinator::remove($scalarOrNullType, new StringType()),
+						new StringType(),
+					);
+				}
+
+				$returnType = $this->handleEmptyStringNullFlag($stringType, $flagsType);
+				return $useDefaultType ? TypeCombinator::union($defaultType, $returnType) : $returnType;
 			}
 		}
 
 		return null;
 	}
 
+	private function handleEmptyStringNullFlag(Type $in, ?Type $flagsType): Type
+	{
+		$hasFlag = $this->hasFlag('FILTER_FLAG_EMPTY_STRING_NULL', $flagsType);
+		if ($hasFlag->no()) {
+			return $in;
+		}
+
+		$hasEmptyString = !$in->isSuperTypeOf(new ConstantStringType(''))->no();
+		if ($hasFlag->maybe()) {
+			return $hasEmptyString ? TypeCombinator::addNull($in) : $in;
+		}
+
+		return $hasEmptyString ? TypeCombinator::remove(TypeCombinator::addNull($in), new ConstantStringType('')) : $in;
+	}
+
 	/** @param array<string, ?Type> $typeOptions */
 	private function applyRangeOptions(Type $type, array $typeOptions, Type $defaultType): Type
 	{
@@ -532,7 +589,7 @@
 	private function canStringBeSanitized(int $filterValue, ?Type $flagsType): TrinaryLogic
 	{
 		// If it is a validation filter, the string will not be changed
-		if (($filterValue & self::VALIDATION_FILTER_BITMASK) !== 0) {
+		if ($this->isValidationFilter($filterValue)) {
 			return TrinaryLogic::createNo();
 		}
 
@@ -547,4 +604,9 @@
 		return TrinaryLogic::createYes();
 	}
 
+	private function isValidationFilter(int $filterValue): bool
+	{
+		return ($filterValue & self::VALIDATION_FILTER_BITMASK) !== 0;
+	}
+
 }