class Analyzer::Php::Php

Defined in:

analyzer/analyzers/php/php.cr

Constant Summary

ALLOW_PATTERNS_RE = Regex.union(["$_GET", "$_POST", "$_REQUEST", "$_SERVER", "$_COOKIE", "$_FILES", "filter_input"])

Precompiled once at load. The per-line gate below used to be allow_patterns.any? { |pattern| line.includes? pattern } — 7 String#includes? scans of the line per pattern. Crystal's String#includes? is measurably slower than a single precompiled Regex#matches? call, and this runs on every line of every .php file in the project, so the union regex is a straight win.

WEBROOT_DIR_NAMES = ["public", "webroot", "public_html", "htdocs", "www", "web"]

Directory names that conventionally hold the document root. A directory only counts as one when it also contains an index.php front controller — that requirement is what keeps this safe: a static-site build output like docs/public/ ships index.html, never index.php, so it is not mistaken for a web root. (See the warning in Analyzer#web_root_path about bare public/ / www/ markers.)

Instance Method Summary

Instance methods inherited from class Analyzer::Php::PhpEngine

analyze analyze, analyze_file(path : String) : Array(Endpoint) analyze_file

Class methods inherited from class Analyzer::Php::PhpEngine

test_path?(path : String) : Bool test_path?

Instance methods inherited from class Analyzer

analyze analyze, base_path : String base_path, base_paths : Array(String) base_paths, callees_needed? : Bool callees_needed?, http_header_name(name : String) : String | Nil http_header_name, line_number_for_index(content : String, char_index : Int32) : Int32 line_number_for_index, logger : NoirLogger logger, parallel_analyze(files : Array(String), &block : String -> Nil) parallel_analyze, read_file_content(path : String) : String read_file_content, result : Array(Endpoint) result, unique_params(params : Array(Param)) : Array(Param) unique_params, url : String url, web_root_path(path : String, markers : Array(String)) : String web_root_path

Constructor methods inherited from class Analyzer

new(options : Hash(String, YAML::Any)) new

Instance methods inherited from module FileHelper

all_files : Array(String) all_files, get_files_by_extension(extension : String) : Array(String) get_files_by_extension, get_files_by_extensions(extensions : Array(String)) : Array(String) get_files_by_extensions, get_files_by_prefix(prefix : String) : Array(String) get_files_by_prefix, get_files_by_prefix_and_extension(prefix : String, extension : String) : Array(String) get_files_by_prefix_and_extension, get_public_dir_files(base_path : String, folder : String) : Array(String) get_public_dir_files, get_public_files(base_path : String, anchors : Array(String) = ["shard.yml", "Gemfile"]) : Array(String) get_public_files

Instance Method Detail

def allow_patterns #

[View source]
def analyze_file(path : String) : Array(Endpoint) #

[View source]