class FrameworkTagger

Included Modules

Direct Known Subclasses

Defined in:

models/framework_tagger.cr

Constant Summary

STATIC_ASSET_EXTENSIONS = [".html", ".htm", ".js", ".mjs", ".cjs", ".css", ".map", ".ico", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".avif", ".bmp", ".woff", ".woff2", ".ttf", ".otf", ".eot", ".wasm"] of ::String

Static-asset file extensions. A route ending in one of these serves a static file off the web server, not a guarded API route.

STATIC_PUBLIC_FILES = Set {"favicon.ico", "robots.txt", "manifest.json", "asset-manifest.json", "sitemap.xml", "service-worker.js", "sw.js", "browserconfig.xml"}

Well-known public files served at the web root.

Constructors

Class Method Summary

Instance Method Summary

Instance methods inherited from module FileHelper

all_files : Array(String) all_files, get_files_by_basename(basename : String) : Array(String) get_files_by_basename, get_files_by_extension(extension : String) : Array(String) get_files_by_extension, get_files_by_extensions(extensions : Array(String)) : Array(String) get_files_by_extensions, get_files_by_prefix(prefix : String) : Array(String) get_files_by_prefix, get_files_by_prefix_and_extension(prefix : String, extension : String) : Array(String) get_files_by_prefix_and_extension, get_files_by_relative_path(relative_path : String, root : String = "") : Array(String) get_files_by_relative_path, get_public_dir_files(base_path : String, folder : String) : Array(String) get_public_dir_files, get_public_files(base_path : String, anchors : Array(String) = ["shard.yml", "Gemfile"]) : Array(String) get_public_files, walked_path(expanded : String) : String walked_path

Instance methods inherited from class Tagger

name : String name, perform(endpoints : Array(Endpoint)) : Array(Endpoint) perform

Constructor methods inherited from class Tagger

new(options : Hash(String, YAML::Any)) new

Constructor Detail

def self.new(options : Hash(String, YAML::Any)) #

[View source]

Class Method Detail

def self.target_techs : Array(String) #

[View source]

Instance Method Detail

def base_relative_path(path : String) : String #

Convention filters ("is this a test file?", "is this vendored?") must match on this, never on the absolute path — see Noir::PathScope.base_relative.


[View source]
def class_level_annotation(path : String, lines : Array(String), annotation_name : String) : String | Nil #

[View source]
def collect_files_by_extension(extension : String) : Array(String) #

Collect files with the given extension across every configured base path, so a multi-root scan sees auth config under all of them.


[View source]
def read_file(path : String) : String | Nil #

[View source]
def read_file_lines(path : String) : Array(String) | Nil #

#read_file split on newlines, cached alongside it.

Taggers walk backwards from an endpoint's line looking for decorators, middleware and guard blocks, so they need the file as lines. They ask once per endpoint (really once per code path per endpoint), which meant re-splitting the same controller for every action it defines: on a Rails app that was the single most expensive thing the -T pass did.

The returned array is shared, so treat it as read-only.


[View source]
def read_source_context(endpoint : Endpoint) : Array(SourceContext) #

[View source]
def static_asset_route?(url : String) : Bool #

A static-file / SPA-shell route, recognized conservatively: the SPA root, a catch-all wildcard mount (/static/*filepath, /*any), a well-known public file, or a static-asset extension. Taggers use this to exempt such routes from broad root/global middleware scopes, where the signal is noise (or a false positive for assets registered outside the middleware chain) rather than a meaningful per-endpoint review target.


[View source]