class

Analyzer::Specification::Nginx

Inherits Analyzer::Specification::SpecificationEngine < Analyzer < FileHelper < Reference < Object

Constants

ACCESS_RE = /\A(allow|deny)\s+(\S+)\z/
AUTH_RE = /\A(auth_basic|auth_request|auth_jwt|satisfy)\s+(.+)\z/
BRACE_RE = /\$\{\w+\}|[{}]/
ENVSUBST_RE = /\$\{\w+\}/

${VAR}: an nginx variable, or an envsubst placeholder. Its braces are not structure.

GLOB_CHARS = /[\\*?\[\]{}]/
INCLUDE_RE = /^include\s+["']?([^"';\s]+)["']?\s*;/
LISTEN_RE = /^listen\b/
LISTEN_TLS_RE = /\bssl\b|\bhttp2\b/
LOCATION_RE = /^location\s+(?:(=|~\*|~|\^~)\s*)?(\S+)/

nginx also reads a modifier glued to the URI (location =/x, location ~^/x).

METHOD_ANY = "ANY"
METHOD_BLOCK_RE = /^if\s*\(\s*\$request_method\s*=\s*([A-Z]+)\s*\)/
SERVER_NAME_RE = /^server_name\s+([^;]+);?/
SETTING_NOTE = " (a setting can make it public)"
TEMPLATE_CLOSE_RE = /\{\{-?\s*end\b/
TEMPLATE_OPEN_RE = /\{\{-?\s*(?:if|with|range)\b/

{{ if }} / {{- with }} ... {{ end }} around directives in a .tmpl / .template file.

Class methods

include_match?(dir : String, pattern : String, file : String) : Bool

Whether file is what pattern (an include glob, /-separated) names under dir. The directory is compared as text, so its own [, { or * are not glob syntax, and only the rest goes through File.match?. Both sides are read with / separators: on Windows a path holds \, which File.match? takes as an escape.

Source
tech_name
Source

Instance methods

analyze

A file included by another is read where the directive sits, with the including block's host, TLS and access rules, and not on its own. Files that only include each other (a cycle no other file reaches) are still read on their own.

Source
snippet_endpoints(content : String, path : String, first_line : Int32) : Array(Endpoint)

Locations of an ingress-nginx server-snippet, read as if written in the server block the controller generates. first_line: the line of path the snippet starts on.

Source
tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source

Nested types