class

Analyzer::Php::ThinkPHP

Inherits Analyzer::Php::PhpEngine < FileScanEngine < Analyzer < FileHelper < Reference < Object

Constants

ALL_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]
BODY_POST_EVIDENCE_RE = Regex.union(["->post(", "post.", "request()->post", "$_POST", "isPost"])

Precompiled once at load: five String#includes? scans of the whole method body OR'd together, replaced with a single Regex#matches? call (Crystal's String#includes? is measurably slower than a precompiled Regex).

INPUT_POST_EVIDENCE_RE = Regex.union(["post.", "->post(", "request()->post"])

Precompiled once at load. Both of these used to be several String#includes? scans of the (whole, unchanging) context buffer OR'd together, re-run once per regex match inside their enclosing context.scan loop below even though context never changes within a single extract_request_params call. Hoisting the check out of the loop and collapsing it into one precompiled Regex#matches? call turns an O(matches) full-buffer rescan into a single O(1) check per call.

ONLY_POST_EVIDENCE_RE = Regex.union(["post.", "->post(", "request()->post", "$_POST", "postMore"])

Class methods

tech_name
Source

Instance methods

analyze_file(path : String) : Array(Endpoint)
Source
tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source