module
Analyzer::Python::Helper
Overview
Shared path helpers for the Python framework analyzers. Kept framework-agnostic so each analyzer can opt in without duplicating the slash-collapse / leading-slash conventions.
Extended Modules
Defined in:
analyzer/analyzers/python/python_helper.crConstant Summary
-
ALIAS_RE =
/\balias\s*=\s*(?:"([^"]*)"|'([^']*)')/ -
VALIDATION_ALIAS_RE =
/\bvalidation_alias\s*=\s*(?:"([^"]*)"|'([^']*)')/ -
alias=renames a parameter on the wire. Every Pydantic-backed Python framework Noir supports spells it the same way — FastAPI'sHeader(alias=...)/Query(alias=...), django-ninja's identical forms, and aField(alias=...)on the body model behind either. With the alias in force the identifier is no longer a name the app answers to, so reporting it hands the next stage (cURL, OpenAPI, a DAST import) a header or field the target rejects.Pydantic v2 splits the input side out as
validation_alias, which wins over a plainaliaswhen both are present, so it is tried first.\bkeeps\baliasfrom matching the tail ofvalidation_alias.
Instance Method Summary
-
#declared_alias(declaration : String) : String | Nil
Callers gate on having seen a real parameter-class call first, so a default that merely contains the text
alias=(mode: str = "alias=1") never reaches here. -
#docstring_line_flags(lines : Array(String)) : Array(Bool)
For each line, whether its first character sits inside a triple-quoted string (i.e.
- #extract_python_string(expression : String) : String | Nil
-
#normalize_path(path : String) : String
Collapse repeated slashes and ensure a single leading slash.
- #normalized_join(prefix : String, path : String) : String
Instance Method Detail
Callers gate on having seen a real parameter-class call first, so a
default that merely contains the text alias= (mode: str = "alias=1") never reaches here.
For each line, whether its first character sits inside a
triple-quoted string (i.e. a docstring opened on an earlier line).
A single linear scan tracks the open/close """/''' delimiters at
file scope; single-line strings and # comments are skipped so a
stray """ inside them doesn't flip the state.
Python API docs routinely spell a full worked example inside a
docstring — Superset's superset_core/rest_api/decorators.py shows
a class MyExtensionAPI(RestApi) with @expose("/hello") in prose —
and a line-oriented route scanner reads those as real routes.
Collapse repeated slashes and ensure a single leading slash.