class

Analyzer::Perl::Cli

Inherits CliEndpointSupport < Analyzer < FileHelper < Reference < Object

Surfaces the command-line attack surface of Perl programs as cli:// endpoints: Getopt::Long (GetOptions) / Getopt::Std (getopts) / Getopt::Long::Descriptive (describe_options) / MooX::Options (option) plus @ARGV indexing and %ENV. Line-scan; root attribution (these libs are flat), merged by URL.

Constants

ARGV_IDX = /\$ARGV\s*\[\s*(\d+)\s*\]/
CLI_TEST_PATH_RE = Regex.union("/t/", "/test/", "_test.")

One precompiled Regex.union scan (PCRE2 JIT) replaces three separate String#includes? scans of the same buffer -- Crystal's includes? is not Boyer-Moore accelerated, so a single regex pass over lower is cheaper than three. Equivalent to the OR-of-substrings it replaces (union escapes each literal).

DESCRIBE_OPT_SPEC = /\[\s*['"]([a-zA-Z][\w-]*)[^'"]*['"]/

describe_options('%c %o', ['verbose|v' => 'be verbose'], ...) — each array-ref's leading quoted spec string. Only the leading identifier is captured so Getopt::Long::Descriptive suffix modifiers (|alias, =s, !, +, :i, ...) don't leak into the reported flag name.

ENV_READ = /\$ENV\{\s*['"]?([A-Za-z_]\w*)['"]?\s*\}/
GETOPT_KEY = /["']([a-zA-Z][\w-]*)[^"']*["']\s*=>\s*\\/

GetOptions("port=i" => $port) — the spec string bound to a reference.

GETOPTS = /\bgetopts?\s*\(\s*['"]([^'"]*)['"]/
MARKERS = /\buse\s+Getopt::(?:Long|Std)\b|\bGetOptions\s*\(|\bgetopts?\s*\(|\buse\s+App::Cmd\b|\bMooseX::Getopt\b|\$ARGV\s*\[\s*\d+\s*\]|\buse\s+Getopt::Long::Descriptive\b|\bdescribe_options\s*\(|\buse\s+MooX::Options\b/
MOOX_MARKER = /\buse\s+MooX::Options\b/
MOOX_OPTION = /\boption\s+['"]([a-zA-Z][\w-]*)['"]\s*=>/

option 'name' => (is => 'ro', ...); — MooX::Options attribute decl. Only extracted when use MooX::Options was actually seen in the file, so an unrelated bareword sub/call literally named option elsewhere doesn't get misattributed as a MooX::Options flag.

WEB_RE = /\buse\s+(?:Mojolicious|Mojo::|Dancer2?|Catalyst|Plack|Dancer)\b/

Class methods

tech_name
Source

Instance methods

analyze
Source
tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source