Analyzer::Ruby::Rails

A read that treats the value as a hash rather than a field. is_a?(String) asks whether the value is a scalar, which is a field.

Parameters Devise's built-in controllers read per {group, action}, paired with the helper method that sanitizes them (user[...] nesting dropped, matching permit extraction). Attached when the action is handled by Devise itself or by a subclass that does not redefine that helper.

Modules assumed when app/models/<scope>.rb is not in the scan. :omniauthable is opt-in and only emits routes when declared on the model.

Devise's Mapping#default_path_names: every key names itself except registration, which is empty (/users/sign_up, not /users/registration/sign_up).

Routes devise_for :scope generates, keyed by the model module that turns them on (devise :database_authenticatable, :registerable, ... in app/models/<scope>.rb). Each tuple is {METHOD, sub_path template, controller group, action}: the template's %{key} slots are the path_names: keys Devise lets an app rename (sign_in: :login), and the group is the controllers: key that swaps the implementing controller (sessions: :sessions).

Routes generated by Doorkeeper's use_doorkeeper (the de-facto OAuth2 provider for Rails — Mastodon, GitLab, Discourse plugins, …). Each tuple is {METHOD, sub_path, group, action}. group matches the skip_controllers symbols so a use_doorkeeper do skip_controllers :applications end block drops the right rows, and indexes the controllers foo: 'bar' remap used to resolve the implementing controller for params/callees. Paths are appended to /oauth under the scope where use_doorkeeper runs.

A call to a method of this controller: a bare or self. identifier, never @ivar (@note is not the note callback) or a method on another receiver (@contact.notes). A trailing [:key] is captured: profile_params[:account_id] reads one field of what the helper permits.

Rails commonly writes compact inline route scopes: collection { get "preview" } / member { post :use } / devise_scope :user do get "login", to: "devise/sessions#new" end. The parser is stack-based, so normalize these to the same do/end structure before route extraction.

A %w[...].each do |var| / %i[...].each_with_index do |var, i| block over a STATIC literal list unrolls to one copy of its body per element with the loop variable's #{var} interpolations substituted. discourse alone wraps ~46 routes in %w[users u].each — without this, get "#{root_path}/..." leaks {root_path} into ~130 endpoints (a fabricated path param) AND the real /users + /u variants are lost.

Only literal %w/%i receivers are expanded: a dynamic Model.scopes.each do |s| cannot be resolved to values at parse time, so it is left for the normal parser (its block opens a neutral frame).

A Const.list receiver (Discourse.filters.each do |filter|) unrolls too when the app defines it as a literal list (see constant_list). The brace form RECV.each { |x| get "#{x}" } is the same block on one line.

noir scans arbitrary untrusted repos, so loop unrolling must not be a DoS vector — expansion is multiplicative (elements ^ nesting). A crafted routes.rb with deep nesting or a huge %w[...] list could otherwise blow up CPU/memory. Real apps use tiny shallow lists (discourse's biggest is the 2-element %w[users u]), so modest caps preserve all genuine recall while bounding the worst case. Over a limit, the block is passed through unexpanded (the pre-unrolling behavior — a transparent frame).

A condition only a non-production Rails env satisfies: Rails.env.test? (development?, local?, an || of them, or one && anything), !Rails.env.production?, or unless Rails.env.production?.

parse_options runs on most DSL lines of every routes.rb file (scope, namespace, resources, member/collection actions, verb routes, match) — i.e. once per line in the main route-parsing hot loop. It used to build two Regex.new("...#{value_pattern}...") regexes from scratch on every call even though value_pattern is a fixed literal that never varies — Crystal doesn't cache/memoize a Regex.new(String) call the way it embeds a non-interpolated regex literal at compile time. Precompile both patterns once at class load instead.

params.permit(, params.require(...).permit(, params.fetch(...).permit(, or Rails 8's params.expect( (anchored to bare params).

Pundit's permitted_attributes(@comment) / permitted_attributes(Comment).

The RESTful actions resources routes, in the order their rows are emitted; update answers both PUT and PATCH. new and edit serve the forms at /posts/new and /posts/:id/edit.

Dir.glob("#{__dir__}/routes/*.rb").each { |f| load f } (zammad) or Dir[Rails.root.join("config/routes/**/*.rb")]: a routes file that globs config/routes/ to load every file in it. Each file usually opens its own routes.draw; parse them in glob (sorted) order.

The glob must name config/routes: a literal config/routes path or, from config/routes.rb itself, #{__dir__}/routes (or a local holding __dir__).

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.