Analyzer::Python::Masonite

Reference: https://docs.masoniteproject.com/features/routing

Masonite (current v4/v5 API) routes live in routes/web.py (and sibling routes/*.py modules such as routes/api.py) as a plain list assigned to ROUTES, built from classmethods on masonite.routes.Route:

Route.get/post/put/patch/delete/options(url, controller, **opts) Route.any(url, controller) -> all six verbs Route.match([methods], url, controller) Route.group([...routes...], prefix=, middleware=, name=, domain=) Route.resource(base_url, controller) -> 7 REST routes Route.api(base_url, controller) -> 5 REST-API routes Route.view(url, template, data) -> GET, no controller Route.redirect/permanent_redirect(url, new) -> GET, no controller

controller is either the documented string binding ('WelcomeController@show', defaulting to __call__ with no @) or a direct class/method reference (WelcomeController.show) — both are handled. Route.fallback(...) (a catch-all with no concrete path) and route .name(...)/.domain(...) are intentionally not modeled — they carry no attack-surface information Noir tracks.

NOTE — Masonite ≤3 used a different, now-legacy routing API: bare Get/Post/RouteGroup classes imported directly from masonite.routes (e.g. Get('/x', 'C@m'), RouteGroup([...], prefix=...)) with controllers resolved under app/http/controllers. That shape is NOT handled here; this analyzer targets the current Route.* DSL used by the official project skeleton (MasoniteFramework/cookie-cutter, app/controllers) and current docs. A legacy-style project still gets detected as Masonite (the detector only looks for masonite imports) but yields no routes from this analyzer.