class

Analyzer::Php::Drupal

Inherits Analyzer::Php::SymfonyRouteAttributes < Analyzer::Php::PhpEngine < FileScanEngine < Analyzer < FileHelper < Reference < Object

Drupal 8+ attack-surface extractor.

Drupal declares its routes in MODULE.routing.yml files built on top of the Symfony routing component. Each top-level key is a route name whose value carries a path, an optional methods list, and a defaults/requirements block:

example.content: path: '/example/{id}' defaults: _controller: '\Drupal\example\Controller\ExampleController::view' methods: [GET] requirements: _permission: 'access content'

We parse only *.routing.yml files — a Drupal tree carries many other YAML files (*.info.yml, *.services.yml, *.libraries.yml, *.schema.yml) that must never be treated as routes. Drupal 10.? and later also take Symfony's #[Route(...)] attribute on controller methods, read from .php files.

A route's requirements are its access checks: _permission, _role, _entity_access and the like are authorization, _user_is_logged_in: 'TRUE' authentication. _access: 'TRUE' lets anyone in.

Constants

NON_ACCESS_REQUIREMENTS = Set {"_access", "_format", "_content_type_format", "_method", "_module_dependencies", "_csrf_token", "_csrf_request_header_token", "_access_rest_csrf", "_user_is_logged_in", "_entity_bundles", "_access_user_register", "_access_theme", "_access_system_cron"}

Requirement keys that check the request, not who makes it, or that let an anonymous caller in (_access_user_register while registration is open; _access_system_cron takes a cron key, not a user).

TAGGER = "drupal_analyzer"

Class methods

tech_name

Source

Instance methods

analyze_file(path : String) : Array(Endpoint)

Source

tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source