class

Analyzer::Php::Drupal

Inherits Analyzer::Php::PhpEngine < FileScanEngine < Analyzer < FileHelper < Reference < Object

Drupal 8+ attack-surface extractor.

Drupal declares its routes in MODULE.routing.yml files built on top of the Symfony routing component. Each top-level key is a route name whose value carries a path, an optional methods list, and a defaults/requirements block:

example.content: path: '/example/{id}' defaults: _controller: '\Drupal\example\Controller\ExampleController::view' methods: [GET] requirements: _permission: 'access content'

We parse only *.routing.yml files — a Drupal tree carries many other YAML files (*.info.yml, *.services.yml, *.libraries.yml, *.schema.yml) that must never be treated as routes.

Class methods

tech_name

Source

Instance methods

analyze_file(path : String) : Array(Endpoint)

Source

tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source