fix: normalize non-finite numbers in data-only event payloads

.changeset/seven-suns-strive.md

@@ -0,0 +1,5 @@
+---
+"posthog-php": patch
+---
+
+Normalize NaN and infinity to null in bounded data-only JSON payloads, while preserving native encoding for objects, references and out-of-budget payloads.

lib/Consumer/File.php

@@ -4,6 +4,7 @@
 
 use Exception;
 use PostHog\Consumer;
+use PostHog\Internal\JsonEncoder;
 
 /**
  * Consumer that writes analytics messages to a local file.
@@ -101,7 +102,7 @@ private function write($body)
             return false;
         }
 
-        $content = json_encode($body);
+        $content = JsonEncoder::encode($body);
         $content .= "\n";
 
         return fwrite($this->file_handle, $content) == strlen($content);

lib/Internal/JsonEncoder.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace PostHog\Internal;
+
+use JsonException;
+use ReflectionReference;
+
+/**
+ * Repairs non-finite numbers in bounded, object/reference-free data payloads.
+ *
+ * @internal
+ */
+final class JsonEncoder
+{
+    private const MAX_DEPTH = 64;
+    private int $remainingValues = 10000;
+    private int $remainingBytes = 1048576;
+    private bool $hasNonFinite = false;
+
+    private function __construct()
+    {
+    }
+
+    public static function encode(mixed $value): string|false
+    {
+        // Opaque callbacks may retain ancestor arrays, so eligibility must precede every copy.
+        $inspection = new self();
+        if ($inspection->eligible($value, 0) && $inspection->hasNonFinite) {
+            $changed = false;
+            $value = self::normalize($value, $changed);
+        }
+        return json_encode($value);
+    }
+
+    private function eligible(mixed $value, int $depth): bool
+    {
+        if (--$this->remainingValues < 0) {
+            return false;
+        }
+        if (is_array($value)) {
+            if ($depth >= self::MAX_DEPTH) {
+                return false;
+            }
+            foreach ($value as $key => $item) {
+                if (
+                    ReflectionReference::fromArrayElement($value, $key) !== null
+                    || (is_string($key) && !$this->eligibleString($key))
+                    || !$this->eligible($item, $depth + 1)
+                ) {
+                    return false;
+                }
+            }
+            return true;
+        }
+        if (is_string($value)) {
+            return $this->eligibleString($value);
+        }
+        if (is_float($value) && !is_finite($value)) {
+            $this->hasNonFinite = true;
+        }
+        return $value === null || is_scalar($value);
+    }
+
+    private function eligibleString(string $value): bool
+    {
+        $this->remainingBytes -= strlen($value);
+        if ($this->remainingBytes < 0) {
+            return false;
+        }
+        // Validation must not reset the JSON error state visible to subsequent native callbacks.
+        try {
+            json_encode($value, JSON_THROW_ON_ERROR);
+            return true;
+        } catch (JsonException) {
+            return false;
+        }
+    }
+
+    private static function normalize(mixed $value, bool &$changed): mixed
+    {
+        $changed = is_float($value) && !is_finite($value);
+        if ($changed) {
+            return null;
+        }
+        if (!is_array($value)) {
+            return $value;
+        }
+        // Compact retained storage first; array_map also preserves numeric-string keys without PHP key coercion.
+        $compact = array_slice($value, 0, null, true);
+        $result = array_map(static function (mixed $item) use (&$changed): mixed {
+            $childChanged = false;
+            $normalized = self::normalize($item, $childChanged);
+            $changed = $changed || $childChanged;
+            return $normalized;
+        }, $compact);
+        return $changed ? $result : $value;
+    }
+}

lib/QueueConsumer.php

@@ -2,6 +2,7 @@
 
 namespace PostHog;
 
+use PostHog\Internal\JsonEncoder;
 use Symfony\Component\Clock\Clock;
 use Throwable;
 
@@ -213,7 +214,7 @@ private function now(): float
      */
     protected function encodeBatchPayload($batch)
     {
-        $payload = json_encode($this->payload($batch));
+        $payload = JsonEncoder::encode($this->payload($batch));
         if (false === $payload) {
             $this->handleError(json_last_error(), "Failed to encode batch payload: " . json_last_error_msg());
             return false;

scripts/PublicApiSnapshot.php

@@ -74,7 +74,10 @@ private static function buildPublicApi(string $sourceDir, string $namespacePrefi
 
         $symbols = [];
         foreach (array_merge(get_declared_interfaces(), get_declared_traits(), get_declared_classes()) as $name) {
-            if (!str_starts_with($name, $namespacePrefix)) {
+            if (
+                !str_starts_with($name, $namespacePrefix)
+                || str_starts_with($name, $namespacePrefix . 'Internal\\')
+            ) {
                 continue;
             }