Analyzer::Java::JavaEngine
Constants
A file that declares no static final String and no interface (whose
fields are implicitly static final) has no constant another file
could reference.
The login / logout / OAuth2 routes: a filter of the chain answers them,
and every one of those filters runs before the AuthorizationFilter,
so no authorizeHttpRequests rule (anyRequest().authenticated())
ever sees the request.
Actuator endpoints every Boot app has once they are exposed; the rest
(prometheus, flyway, ...) need their own dependency, so they are
emitted only when exposure.include names them.
Annotations Spring itself binds or validates from the request; a resolver that checks them does not make them server-filled.
Comments and Maven <dependencyManagement> (which only pins versions)
are not dependencies; masked to spaces so offsets keep their lines.
securityMatcher(s)(...) / Spring 5 http.antMatcher(...) /
http.requestMatcher(...): the requests a chain (and so its filters) sees.
Where one security chain's source starts (its bean method).
Spring Boot's four classpath defaults for spring.web.resources.static-locations.
logoutRequestMatcher(new AntPathRequestMatcher("/x"[, "GET"])).
.logoutSuccessHandler(handler) / (new Impl()), Kotlin
logoutSuccessHandler = handler.
.formLogin( / .logout( (Java, Kotlin http. calls) or the Kotlin
DSL's formLogin { — a bare logout( is any app's own method, and a
dotted one counts only on an HttpSecurity chain (spring_security_receiver?).
Files that configure an HttpSecurity / ServerHttpSecurity chain.
Takes the scan-base-relative path (Analyzer#base_relative_path),
never the absolute one. The layout is a contract between the build
tool and the project, so matching the absolute path let a
directory above the scan base decide the answer — a CI job that
checks out under a src/test/ step directory silently lost 375 of
the fixture tree's 396 endpoints.
FooTest.java / FooTests.java (and .kt, which Javalin, Micronaut,
Quarkus and JAX-RS read through the same predicate) are JUnit classes
even when they sit in src/main/java of a published test kit (the
Micronaut TCK declares its @Requires(property = "spec.name")
controllers there). The suffix check is case-sensitive, so
Latest.java is not a hit, and it needs a name before the suffix: a
class literally called Test or Tests is a tutorial's servlet, not
a test.
Maven/Gradle pin test sources to src/test/<lang>/ — java,
kotlin, scala, groovy all share the layout. Real route
handlers never live there, but Quarkus, Micronaut, Spring,
Javalin, JAX-RS and friends routinely declare inline
controllers under src/test/java/... to exercise the
framework. The path layout is part of the build tool's
contract so the prefix check is unambiguous.
Also covers Maven's archetype source-roots
(src/it/, integration-test convention used by some Quarkus
extensions and Apache projects) which sit alongside src/test/,
and Gradle's extra test source sets (testFixtures, jmh,
integrationTest, functionalTest, and integration from the
com.coditory.integration-test plugin).
Class methods
Spring's ant match of a request path (/** also matches the bare prefix).
Yields each char after char index index with its char index.
Index of the delimiter closing the open_char at open_idx, or nil when
the source runs out first. String and char literals are skipped, so a
)/} inside "…" or '…' cannot close the block early.
Scan by CHARACTER (not byte): open_idx is a char index from
String#index and callers char-slice with — or range-compare — the
returned index. A byte scan corrupts both on multi-byte UTF-8.
ASCII-identical to the previous byte loop. The walk starts at
open_idx rather than skipping up to it from the file head, which
made one call per route quadratic over a large file.
The project file declaring the JVM type type as source names it:
by its single-type import, else in source's own package.
Module root of a Maven/Gradle source file: everything before
/src/main/java/ (or /src/main/kotlin/) below base, or the file's
own directory outside that layout.
The char range of the security chain (bean method) holding offset.
The login / logout / OAuth2 endpoints Spring Security's filters serve
for each formLogin / logout / oauth2Login of an HttpSecurity
chain, with the configured URLs and parameter names or Spring's
defaults. code is comment-stripped source. Values are string
literals or static final String / const val constants of the file;
a URL set any other way (a constant of another class, a request
matcher) is unknown, so that configurer yields no route rather than
the default one.
Replaces // line comments and /* */ block comments with spaces
(newlines preserved) so a commented-out annotation or call is never
mistaken for a live one, while keeping every real line number stable
for PathInfo reporting. String and char literals are tracked so //
or /* inside a literal (e.g. a URL default value "http://x//y") is
never treated as a comment opener.
True when the type name written in file (simple or qualified,
generic arguments ignored) is fqn, resolved the way javac does: a
qualified name stands for itself; a simple one goes to a single-type
import, then a type the file declares, then its own package, then an
on-demand import. unresolved answers when none of those names it (a
type from an implicit or unscanned package).