Analyzer::Python::Helper
Shared path helpers for the Python framework analyzers. Kept framework-agnostic so each analyzer can opt in without duplicating the slash-collapse / leading-slash conventions.
Constants
alias= renames a parameter on the wire. Every Pydantic-backed Python
framework Noir supports spells it the same way — FastAPI's
Header(alias=...) / Query(alias=...), django-ninja's identical
forms, and a Field(alias=...) on the body model behind either. With
the alias in force the identifier is no longer a name the app answers
to, so reporting it hands the next stage (cURL, OpenAPI, a DAST
import) a header or field the target rejects.
Pydantic v2 splits the input side out as validation_alias, which
wins over a plain alias when both are present, so it is tried first.
\b keeps \balias from matching the tail of validation_alias.
Instance methods
Callers gate on having seen a real parameter-class call first, so a
default that merely contains the text alias= (mode: str = "alias=1") never reaches here.
For each line, whether its first character sits inside a
triple-quoted string (i.e. a docstring opened on an earlier line).
A single linear scan tracks the open/close """/''' delimiters at
file scope; single-line strings and # comments are skipped so a
stray """ inside them doesn't flip the state.
Python API docs routinely spell a full worked example inside a
docstring — Superset's superset_core/rest_api/decorators.py shows
a class MyExtensionAPI(RestApi) with @expose("/hello") in prose —
and a line-oriented route scanner reads those as real routes.
The leading string literal of expression, with Python's implicit
concatenation joined (r"^a/" r"b/" is one pattern) and a
parenthesised group of literals unwrapped ((r"^a/" r"b/")).
Collapse repeated slashes and ensure a single leading slash.