class

Analyzer::Php::Wordpress

Inherits Analyzer::Php::PhpEngine < FileScanEngine < Analyzer < FileHelper < Reference < Object

WordPress attack-surface extractor.

WordPress does not expose a conventional route table; its HTTP surface is registered imperatively through a handful of well-known APIs:

  • REST API — register_rest_route( $namespace, $route, $args ) served under /wp-json/{namespace}/{route}.
  • Admin AJAX — add_action( 'wp_ajax_{action}', ... ) and the public wp_ajax_nopriv_{action} variant, dispatched by /wp-admin/admin-ajax.php?action={action}.
  • Admin POST — add_action( 'admin_post_{action}', ... ) / admin_post_nopriv_{action}, dispatched by /wp-admin/admin-post.php?action={action}.

Constants

ADMIN_AJAX_PATH = "/wp-admin/admin-ajax.php"
ADMIN_POST_PATH = "/wp-admin/admin-post.php"
ALL_HTTP_VERBS = ["GET", "POST", "PUT", "PATCH", "DELETE"]
DISPATCH_METHODS = ["GET", "POST"]

WordPress admin-ajax / admin-post dispatch on $_REQUEST['action'], so both verbs are valid entry points.

REST_METHOD_CONSTANTS = {"READABLE" => ["GET"], "CREATABLE" => ["POST"], "EDITABLE" => ["POST", "PUT", "PATCH"], "DELETABLE" => ["DELETE"], "ALLMETHODS" => ["GET", "POST", "PUT", "PATCH", "DELETE"]}

WP_REST_Server:: method-group constants → concrete HTTP verbs.

SPLIT_ARGS_RULES = Noir::TopLevelSplit::Rules.new(nest: (Noir::TopLevelSplit::Nest::Paren | Noir::TopLevelSplit::Nest::Bracket) | Noir::TopLevelSplit::Nest::Brace, quotes: "\"'", escape: Noir::TopLevelSplit::Escape::InQuotes, strip: false, empties: Noir::TopLevelSplit::Empties::DropTrailing, per_kind: false, clamp: false)

Rules::SHARED_DEPTH_RAW with a trailing empty dropped and, like erlang/cowboy.cr, WITHOUT clamping: the body this replaces closed brackets with a bare depth -= 1, so a fragment beginning with a closer (")x, y") drives depth negative and stops splitting. That is observable on the regex-sliced input this actually receives, so it is preserved rather than normalised.

File-local because wordpress is the only splitter pairing clamp: false with unstripped parts.

Class methods

tech_name
Source

Instance methods

analyze_file(path : String) : Array(Endpoint)
Source
tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source