hullproof 0.0.0-stage → 0.5.0

package/dist/map/mobile.js

@@ -0,0 +1,326 @@
+import { empty, makeEntry } from './entry.js';
+import { Lines } from './lex.js';
+// Names that say a value is a secret. A key that is public by design (a maps key, a Firebase web key, an analytics id) is not one.
+const SECRET_NAME = /(?:secret|private[_.\- ]?key|passw(?:or)?d|passwd|signing[_.\- ]?key|service[_.\- ]?role|auth[_.\- ]?token|access[_.\- ]?token|refresh[_.\- ]?token)/i;
+const PUBLIC_NAME = /(?:public|publishable|client[_.\- ]?id|maps|geo|analytics|sentry[_.\- ]?dsn)/i;
+const PLACEHOLDER = /^(?:@|\$\(|\$\{|%|<|your[_\- ]|changeme|change[_\- ]me|todo|xxx|null|none|true|false|\s*$)/i;
+export const isSecretValue = (name, value) => SECRET_NAME.test(name) && !PUBLIC_NAME.test(name) && value.length >= 8 && !PLACEHOLDER.test(value.trim());
+const blankComments = (t) => t.replace(/<!--[\s\S]*?-->/g, (c) => c.replace(/[^\n]/g, ' '));
+const view = (file, text) => ({ file, text, masked: text, lang: 'kt', lines: new Lines(text), imports: '' });
+const bool = (v) => (v === 'true' ? true : v === 'false' ? false : null);
+function tokens(text) {
+    const out = [];
+    for (const m of text.matchAll(/<(\/?)([A-Za-z_][\w.:-]*)((?:[^>"']|"[^"]*"|'[^']*')*?)(\/?)>/g)) {
+        const attrs = {};
+        for (const a of m[3].matchAll(/([\w:.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g))
+            attrs[a[1]] = a[2] ?? a[3] ?? '';
+        out.push({ name: m[2], close: m[1] === '/', self: m[4] === '/', attrs, at: m.index, end: m.index + m[0].length });
+    }
+    return out;
+}
+const COMPONENTS = new Set(['activity', 'activity-alias', 'service', 'receiver', 'provider']);
+export function readManifest(file, text, gradleTarget) {
+    const clean = blankComments(text);
+    const lines = new Lines(text);
+    const toks = tokens(clean);
+    const secrets = [];
+    const bounds = new Map();
+    const pkg = toks.find((t) => t.name === 'manifest')?.attrs.package ?? null;
+    const sdk = toks.find((t) => t.name === 'uses-sdk');
+    const targetRaw = sdk?.attrs['android:targetSdkVersion'];
+    const target = targetRaw && /^\d+$/.test(targetRaw) ? Number(targetRaw) : gradleTarget;
+    const app = toks.find((t) => t.name === 'application' && !t.close);
+    const manifest = {
+        file, package: pkg, line: lines.at(app?.at ?? 0), debuggable: bool(app?.attrs['android:debuggable']), allow_backup: bool(app?.attrs['android:allowBackup']),
+        uses_cleartext_traffic: bool(app?.attrs['android:usesCleartextTraffic']), network_security_config: app?.attrs['android:networkSecurityConfig'] ?? null,
+        target_sdk: target, permissions: toks.filter((t) => t.name === 'uses-permission' && !t.close).map((t) => t.attrs['android:name']).filter(Boolean).sort(), components: [],
+    };
+    let cur = null;
+    let curStart = 0;
+    let filter = null;
+    let hasFilter = false;
+    const finish = (endAt) => {
+        if (!cur)
+            return;
+        // A component with an intent filter and no explicit flag is exported before Android 12 (target SDK 31).
+        if (!cur.exported_explicit)
+            cur.exported = hasFilter && (target === null || target < 31);
+        bounds.set(cur, [curStart, endAt]);
+        manifest.components.push(cur);
+        cur = null;
+    };
+    for (const t of toks) {
+        if (t.name === 'meta-data' && !t.close) {
+            const n = t.attrs['android:name'] ?? '';
+            const v = t.attrs['android:value'] ?? '';
+            if (isSecretValue(n, v))
+                secrets.push({ file, line: lines.at(t.at), key: n, where: 'android manifest' });
+            continue;
+        }
+        if (COMPONENTS.has(t.name)) {
+            if (t.close) {
+                finish(t.end);
+                continue;
+            }
+            finish(t.at);
+            const nm = t.attrs['android:name'] ?? '';
+            const full = nm.startsWith('.') ? `${pkg ?? ''}${nm}` : nm.includes('.') ? nm : `${pkg ?? ''}.${nm}`;
+            const perm = t.attrs['android:permission'] ?? t.attrs['android:readPermission'] ?? t.attrs['android:writePermission'] ?? null;
+            const ex = t.attrs['android:exported'];
+            cur = { kind: t.name === 'activity-alias' ? 'activity' : t.name, name: full, line: lines.at(t.at), exported: ex === 'true', exported_explicit: ex !== undefined, permission: perm, launcher: false, filters: [] };
+            curStart = t.at;
+            hasFilter = false;
+            if (t.self)
+                finish(t.end);
+            continue;
+        }
+        if (!cur)
+            continue;
+        if (t.name === 'intent-filter') {
+            if (t.close) {
+                if (filter)
+                    cur.filters.push(filter);
+                filter = null;
+            }
+            else {
+                filter = { actions: [], categories: [], schemes: [], hosts: [], paths: [] };
+                hasFilter = true;
+            }
+            continue;
+        }
+        if (!filter || t.close)
+            continue;
+        if (t.name === 'action')
+            filter.actions.push(t.attrs['android:name'] ?? '');
+        else if (t.name === 'category')
+            filter.categories.push(t.attrs['android:name'] ?? '');
+        else if (t.name === 'data') {
+            const a = t.attrs;
+            if (a['android:scheme'])
+                filter.schemes.push(a['android:scheme']);
+            if (a['android:host'])
+                filter.hosts.push(a['android:host']);
+            const p = a['android:path'] ?? a['android:pathPrefix'] ?? a['android:pathPattern'] ?? a['android:pathAdvancedPattern'];
+            if (p)
+                filter.paths.push(p);
+        }
+    }
+    finish(clean.length);
+    for (const c of manifest.components)
+        c.launcher = c.filters.length > 0 && c.filters.every((f) => f.actions.every((a) => a === 'android.intent.action.MAIN') && f.categories.includes('android.intent.category.LAUNCHER'));
+    for (const c of manifest.components) {
+        c.filters.forEach((f) => { f.actions.sort(); f.categories.sort(); f.schemes.sort(); f.hosts.sort(); f.paths.sort(); });
+    }
+    manifest.components.sort((a, b) => a.line - b.line || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    return { manifest, secrets, bounds };
+}
+export function readNetworkSecurity(file, text) {
+    const clean = blankComments(text);
+    const lines = new Lines(text);
+    const toks = tokens(clean);
+    const base = toks.find((t) => t.name === 'base-config' && !t.close);
+    const domains = [];
+    let pins = 0;
+    let inDomainConfig = null;
+    let userCerts = false;
+    let cleartextDomains = [];
+    const pending = [];
+    for (const t of toks) {
+        if (t.name === 'domain-config') {
+            if (t.close) {
+                if (inDomainConfig?.attrs.cleartextTrafficPermitted === 'true')
+                    cleartextDomains = cleartextDomains.concat(pending);
+                pending.length = 0;
+                inDomainConfig = null;
+            }
+            else {
+                inDomainConfig = t;
+                pending.length = 0;
+            }
+        }
+        else if (t.name === 'domain' && !t.close && inDomainConfig) {
+            const d = clean.slice(t.end, clean.indexOf('<', t.end)).trim();
+            if (d) {
+                domains.push(d);
+                pending.push(d);
+            }
+        }
+        else if (t.name === 'pin' && !t.close)
+            pins++;
+        else if (t.name === 'certificates' && t.attrs.src === 'user')
+            userCerts = true;
+    }
+    return { file, line: lines.at(base?.at ?? 0), cleartext_base: bool(base?.attrs.cleartextTrafficPermitted), cleartext_domains: cleartextDomains.sort(), trusts_user_certs: userCerts, pinned_domains: pins };
+}
+function readPlist(text) {
+    const lines = new Lines(text);
+    const toks = [...blankComments(text).matchAll(/<(\/?)(dict|array|key|string|integer|real|true|false|data|date)\b[^>]*?(\/?)>/g)];
+    let i = 0;
+    const keyLines = new Map();
+    const textAfter = (m) => text.slice(m.index + m[0].length, text.indexOf('<', m.index + m[0].length));
+    const value = () => {
+        const t = toks[i++];
+        if (!t)
+            return '';
+        if (t[2] === 'true')
+            return true;
+        if (t[2] === 'false')
+            return false;
+        if (t[2] === 'string' || t[2] === 'data' || t[2] === 'date') {
+            const v = t[3] === '/' ? '' : textAfter(t);
+            if (t[3] !== '/')
+                i++;
+            return v;
+        }
+        if (t[2] === 'integer' || t[2] === 'real') {
+            const v = Number(textAfter(t));
+            i++;
+            return v;
+        }
+        if (t[2] === 'array') {
+            const a = [];
+            while (i < toks.length && !(toks[i][1] === '/' && toks[i][2] === 'array'))
+                a.push(value());
+            i++;
+            return a;
+        }
+        if (t[2] === 'dict') {
+            const d = {};
+            while (i < toks.length && !(toks[i][1] === '/' && toks[i][2] === 'dict')) {
+                const k = toks[i];
+                if (k[2] !== 'key' || k[1] === '/') {
+                    i++;
+                    continue;
+                }
+                const name = textAfter(k);
+                keyLines.set(name, lines.at(k.index));
+                i += 2;
+                d[name] = value();
+            }
+            i++;
+            return d;
+        }
+        return '';
+    };
+    const start = toks.findIndex((t) => t[2] === 'dict' && t[1] !== '/');
+    if (start < 0)
+        return null;
+    i = start;
+    const v = value();
+    return typeof v === 'object' && !Array.isArray(v) ? { value: v, keyLines } : null;
+}
+const strList = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
+export function readPlistFile(file, text) {
+    const r = readPlist(text);
+    if (!r)
+        return null;
+    const d = r.value;
+    const ats = typeof d.NSAppTransportSecurity === 'object' && !Array.isArray(d.NSAppTransportSecurity) ? d.NSAppTransportSecurity : null;
+    const secrets = [];
+    for (const [k, v] of Object.entries(d))
+        if (typeof v === 'string' && isSecretValue(k, v))
+            secrets.push({ file, line: r.keyLines.get(k) ?? 1, key: k, where: 'ios plist' });
+    const types = Array.isArray(d.CFBundleURLTypes) ? d.CFBundleURLTypes : [];
+    const schemes = types.flatMap((t) => (typeof t === 'object' && !Array.isArray(t) ? strList(t.CFBundleURLSchemes) : []));
+    const line = r.keyLines.get('CFBundleURLTypes') ?? 1;
+    const assoc = strList(d['com.apple.developer.associated-domains']).filter((x) => x.startsWith('applinks:')).map((x) => x.slice('applinks:'.length).replace(/\?.*$/, ''));
+    return {
+        plist: {
+            file, ats_arbitrary_loads: ats && typeof ats.NSAllowsArbitraryLoads === 'boolean' ? ats.NSAllowsArbitraryLoads : null, ats_line: r.keyLines.get('NSAllowsArbitraryLoads') ?? null,
+            url_schemes: schemes.slice().sort(), associated_domains: assoc.slice().sort(), usage_descriptions: Object.keys(d).filter((k) => /UsageDescription$/.test(k)).sort(),
+        },
+        secrets, urlSchemes: schemes.map((scheme) => ({ scheme, line })), domains: assoc.map((domain) => ({ domain, line: r.keyLines.get('com.apple.developer.associated-domains') ?? 1 })),
+    };
+}
+const SKIP = /(?:^|\/)(?:Pods|Carthage|\.build|DerivedData|node_modules|build|intermediates)\//;
+export function mobileFiles(repo) {
+    const f = repo.ctx.files.filter((x) => !SKIP.test(x));
+    return {
+        manifests: f.filter((x) => /(?:^|\/)AndroidManifest\.xml$/.test(x) && !/\/build\//.test(x)),
+        netsec: f.filter((x) => /(?:^|\/)res\/xml\/[\w-]*network_security_config\w*\.xml$/.test(x)),
+        strings: f.filter((x) => /(?:^|\/)res\/values[\w-]*\/strings\.xml$/.test(x)),
+        plists: f.filter((x) => /(?:^|\/)Info\.plist$|\.entitlements$/.test(x)),
+    };
+}
+const gradleTarget = (repo) => {
+    for (const f of repo.ctx.files.filter((x) => /(?:^|\/)build\.gradle(?:\.kts)?$/.test(x))) {
+        const m = /\btargetSdk(?:Version)?\s*[= ]\s*(\d+)/.exec(repo.ctx.text(f));
+        if (m)
+            return Number(m[1]);
+    }
+    return null;
+};
+export function mobileFacts(repo) {
+    const files = mobileFiles(repo);
+    const secrets = [];
+    let android = null;
+    if (files.manifests.length || files.netsec.length) {
+        const target = gradleTarget(repo);
+        android = { manifests: [], network_security: files.netsec.map((f) => readNetworkSecurity(f, repo.ctx.text(f))) };
+        for (const f of files.manifests) {
+            const r = readManifest(f, repo.ctx.text(f), target);
+            android.manifests.push(r.manifest);
+            secrets.push(...r.secrets);
+        }
+        for (const f of files.strings) {
+            const t = repo.ctx.text(f);
+            const lines = new Lines(t);
+            for (const m of blankComments(t).matchAll(/<string\s+name="([^"]+)"[^>]*>([^<]*)<\/string>/g))
+                if (isSecretValue(m[1], m[2]))
+                    secrets.push({ file: f, line: lines.at(m.index), key: m[1], where: 'android strings' });
+        }
+    }
+    let ios = null;
+    const plists = files.plists.map((f) => ({ f, r: readPlistFile(f, repo.ctx.text(f)) })).filter((x) => x.r !== null);
+    if (plists.length) {
+        ios = { plists: plists.map((x) => x.r.plist) };
+        for (const x of plists)
+            secrets.push(...x.r.secrets);
+    }
+    const sorted = secrets.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : 0) || a.line - b.line || (a.key < b.key ? -1 : 1));
+    return { android, ios, secrets: sorted };
+}
+// ---- entry points -----------------------------------------------------------------------------------------------------------------
+export function extractMobile(repo) {
+    const out = empty();
+    const files = mobileFiles(repo);
+    const target = gradleTarget(repo);
+    for (const f of files.manifests) {
+        const text = repo.ctx.text(f);
+        const v = view(f, text);
+        const { manifest, bounds } = readManifest(f, text, target);
+        for (const c of manifest.components) {
+            if (!c.exported || c.launcher)
+                continue;
+            const [s, e] = bounds.get(c) ?? [0, 0];
+            const prot = c.permission ? [{ kind: 'role_check', scope: 'handler', file: f, line: c.line, via: `android:permission ${c.permission}`, enforced: true, confidence: 'high' }] : [];
+            const analysis = { protections: prot, reads: [], data: [], outbound: [], taint: { names: new Set(), validated: new Set(), trusted: new Set() } };
+            const links = c.filters.filter((x) => x.actions.includes('android.intent.action.VIEW') && x.categories.includes('android.intent.category.BROWSABLE') && x.schemes.length);
+            if (c.kind === 'activity' && links.length) {
+                const names = new Set();
+                for (const fl of links)
+                    for (const sc of fl.schemes)
+                        for (const h of fl.hosts.length ? fl.hosts : [''])
+                            for (const p of fl.paths.length ? fl.paths : [''])
+                                names.add(`${sc}://${h}${p}`);
+                for (const n of [...names].sort())
+                    out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'android', file: f, line: c.line, method: null, path: null, name: n, confidence: 'high', handlerView: v, spec: { start: s, end: e, seeds: [] }, analysis, tags: ['public'] }));
+                continue;
+            }
+            out.entries.push(makeEntry(repo, { kind: 'ipc', framework: 'android', file: f, line: c.line, method: null, path: null, name: c.name, confidence: c.exported_explicit ? 'high' : 'medium', handlerView: v, spec: { start: s, end: e, seeds: [] }, analysis }));
+        }
+    }
+    for (const f of files.plists) {
+        const text = repo.ctx.text(f);
+        const r = readPlistFile(f, text);
+        if (!r)
+            continue;
+        const v = view(f, text);
+        const analysis = { protections: [], reads: [], data: [], outbound: [], taint: { names: new Set(), validated: new Set(), trusted: new Set() } };
+        for (const u of r.urlSchemes)
+            out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'ios', file: f, line: u.line, method: null, path: null, name: `${u.scheme}://`, confidence: 'high', handlerView: v, spec: { start: 0, end: 0, seeds: [] }, analysis, tags: ['public'] }));
+        for (const d of r.domains)
+            out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'ios', file: f, line: d.line, method: null, path: null, name: `https://${d.domain}/`, confidence: 'high', handlerView: v, spec: { start: 0, end: 0, seeds: [] }, analysis, tags: ['public'] }));
+    }
+    return out;
+}

package/dist/map/py-django.js

@@ -0,0 +1,281 @@
+import { empty, joinPath, makeEntry, normPath } from './entry.js';
+import { closeOf, pyBlock, splitArgs } from './lex.js';
+import { classDecos, decoratorGroups, pyParams, pyClassMethods, resolvePyModule } from './py.js';
+const GENERIC = {
+    ListAPIView: ['GET'], CreateAPIView: ['POST'], RetrieveAPIView: ['GET'], UpdateAPIView: ['PUT', 'PATCH'], DestroyAPIView: ['DELETE'],
+    ListCreateAPIView: ['GET', 'POST'], RetrieveUpdateAPIView: ['GET', 'PUT', 'PATCH'], RetrieveDestroyAPIView: ['GET', 'DELETE'],
+    RetrieveUpdateDestroyAPIView: ['GET', 'PUT', 'PATCH', 'DELETE'], ModelViewSet: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
+    ReadOnlyModelViewSet: ['GET'], ListModelMixin: ['GET'], CreateModelMixin: ['POST'], DestroyModelMixin: ['DELETE'],
+};
+const routeText = (t) => /^\s*[rRuU]?(['"])((?:\\.|(?!\1).)*)\1/.exec(t)?.[2] ?? null;
+const cleanRoute = (r) => normPath(r.replace(/^\^/, '').replace(/\$$/, '').replace(/\(\?P<(\w+)>[^)]*\)/g, ':$1').replace(/\\\//g, '/'));
+function parseUrlConf(repo, v) {
+    if (!/\burlpatterns\b/.test(v.masked))
+        return null;
+    const conf = { file: v.file, view: v, patterns: [], routers: new Map() };
+    // Lists of patterns defined in this file (api_urls = [...]): a pattern belongs to the innermost list that holds it.
+    const lists = [];
+    for (const l of v.masked.matchAll(/^(\w+)\s*(?::[^=\n]+)?=\s*\[/gm)) {
+        const open = l.index + l[0].length - 1;
+        const close = closeOf(v.masked, open);
+        if (close > 0)
+            lists.push({ name: l[1], from: open, to: close });
+    }
+    for (const m of v.masked.matchAll(/(?<![\w.])(path|re_path|url)\s*\(/g)) {
+        const open = m.index + m[0].length - 1;
+        const args = splitArgs(v.masked, open);
+        if (args.length < 2)
+            continue;
+        const route = routeText(v.text.slice(args[0].start, args[0].end));
+        if (route === null)
+            continue;
+        const viewText = v.text.slice(args[1].start, args[1].end);
+        const inc = /^include\s*\(\s*([\s\S]*)\)\s*$/.exec(viewText);
+        let includeFile = null;
+        let routerName = null;
+        let includeList = null;
+        if (inc) {
+            const lit = /^\(?\s*['"]([\w.]+)['"]/.exec(inc[1])?.[1];
+            const rn = /^(\w+)\.urls/.exec(inc[1])?.[1];
+            const own = /^\(?\s*(\w+)\s*\)?\s*$/.exec(inc[1])?.[1];
+            if (own && lists.some((x) => x.name === own))
+                includeList = own;
+            else if (lit)
+                includeFile = resolvePyModule(repo, v.file, lit);
+            else if (rn)
+                routerName = rn;
+            else {
+                const id = /^\(?\s*(\w+)/.exec(inc[1])?.[1];
+                if (id) {
+                    const imp = [...v.text.matchAll(new RegExp(`from\\s+([\\w.]+)\\s+import\\s+[^\\n]*\\b${id}\\b`, 'g'))][0];
+                    includeFile = resolvePyModule(repo, v.file, imp ? `${imp[1]}.${id}` : id) ?? (imp ? resolvePyModule(repo, v.file, imp[1]) : null);
+                }
+            }
+        }
+        const holder = lists.filter((x) => m.index > x.from && m.index < x.to).sort((a, b) => (a.to - a.from) - (b.to - b.from))[0];
+        conf.patterns.push({ route: cleanRoute(route), viewText: inc ? '' : viewText, line: v.lines.at(m.index), includeFile, routerName, list: holder?.name ?? null, includeList });
+    }
+    for (const m of v.masked.matchAll(/\b(\w+)\.register\s*\(/g)) {
+        const open = m.index + m[0].length - 1;
+        const args = splitArgs(v.masked, open);
+        if (args.length < 2)
+            continue;
+        const prefix = routeText(v.text.slice(args[0].start, args[0].end));
+        const vs = /^[A-Za-z_][\w.]*/.exec(v.text.slice(args[1].start, args[1].end))?.[0];
+        if (prefix === null || !vs)
+            continue;
+        const list = conf.routers.get(m[1]) ?? [];
+        list.push({ prefix: cleanRoute(prefix), viewset: vs.split('.').pop(), line: v.lines.at(m.index) });
+        conf.routers.set(m[1], list);
+    }
+    return conf;
+}
+// The function a url pattern names. A dotted reference (views.add) is followed through the import in the url file, a bare name through
+// "from x import name", and otherwise a def of that name in a views module wins over one in a model, an admin class or a command.
+function pickView(repo, urls, expr, fnName) {
+    const defs = repo.defs('py', fnName);
+    if (defs.length <= 1)
+        return defs[0];
+    const ref = /^([\w.]+)/.exec(expr)?.[1] ?? fnName;
+    const parts = ref.split('.');
+    let file = null;
+    if (parts.length > 1) {
+        const mod = parts[parts.length - 2];
+        const imp = new RegExp(`from\\s+([.\\w]+)\\s+import\\s+(?:[^\\n]*,\\s*)?${mod}\\b|import\\s+([.\\w]+)\\s+as\\s+${mod}\\b`).exec(urls.text);
+        if (imp)
+            file = imp[2] ? resolvePyModule(repo, urls.file, imp[2]) : (resolvePyModule(repo, urls.file, `${imp[1].replace(/\.$/, '')}.${mod}`) ?? resolvePyModule(repo, urls.file, imp[1]));
+    }
+    else {
+        const imp = new RegExp(`from\\s+([.\\w]+)\\s+import\\s+[^\\n]*\\b${fnName}\\b`).exec(urls.text);
+        if (imp)
+            file = resolvePyModule(repo, urls.file, imp[1]);
+    }
+    const hit = file ? defs.filter((x) => x.view.file === file) : [];
+    if (hit.length)
+        return hit[0];
+    const dir = urls.file.includes('/') ? urls.file.slice(0, urls.file.lastIndexOf('/') + 1) : '';
+    const rank = (f) => (/(?:^|\/)views?(?:\/|\.py$|_)/.test(f) ? 0 : f.startsWith(dir) ? 1 : 2) + (/(?:admin|models?|management|tests?)(?:\/|\.py$)/.test(f) ? 3 : 0);
+    return defs.slice().sort((a, b) => rank(a.view.file) - rank(b.view.file))[0];
+}
+function findClass(repo, name, near) {
+    const files = [near, ...repo.filesOf('py').filter((f) => f !== near)];
+    for (const f of files) {
+        const view = repo.view(f);
+        if (!view)
+            continue;
+        const m = new RegExp(`^class\\s+${name}\\b[^\\n]*:`, 'm').exec(view.masked);
+        if (m)
+            return { view, at: m.index };
+    }
+    return null;
+}
+export function extractDjango(repo) {
+    const out = empty();
+    const confs = new Map();
+    for (const f of repo.filesOf('py')) {
+        if (!/urls?\.py$|urlconf|routing|routes/.test(f) && !/urlpatterns/.test(repo.ctx.text(f)))
+            continue;
+        const v = repo.view(f);
+        const c = v ? parseUrlConf(repo, v) : null;
+        if (c)
+            confs.set(f, c);
+    }
+    if (!confs.size)
+        return out;
+    const included = new Set();
+    for (const c of confs.values())
+        for (const p of c.patterns)
+            if (p.includeFile)
+                included.add(p.includeFile);
+    const roots = [...confs.keys()].filter((f) => !included.has(f)).sort();
+    const emitted = new Set();
+    const emitView = (c, prefix, p, viewExpr, route, depth) => {
+        void depth;
+        const full = joinPath(prefix, route);
+        const v = c.view;
+        if (/admin\.site\.urls/.test(viewExpr)) {
+            const e = makeEntry(repo, { kind: 'http_route', framework: 'django-admin', file: v.file, line: p.line, method: 'ANY', path: joinPath(full, '*'), name: 'django admin', confidence: 'medium', handlerView: v, spec: { start: 0, end: 0, seeds: [], decorators: [], returnsJson: false }, tags: ['admin'] });
+            e.protections.push({ kind: 'session_read', scope: 'global', file: v.file, line: p.line, via: 'django admin site login', enforced: true, confidence: 'high' }, { kind: 'role_check', scope: 'global', file: v.file, line: p.line, via: 'django admin is_staff', enforced: true, confidence: 'high' });
+            out.entries.push(e);
+            return;
+        }
+        const asView = /^([\w.]+?)\.as_view\s*\(/.exec(viewExpr);
+        if (asView) {
+            const cls = asView[1].split('.').pop();
+            const found = findClass(repo, cls, v.file);
+            if (!found)
+                return;
+            emitClass(repo, found.view, found.at, cls, full, out);
+            return;
+        }
+        const fnName = /^([\w.]+)\s*(?:,|$)/.exec(viewExpr.trim())?.[1]?.split('.').pop();
+        if (!fnName)
+            return;
+        const d = pickView(repo, v, viewExpr.trim(), fnName);
+        if (!d)
+            return;
+        const b = pyBlock(d.view.masked, d.view.lines, d.start);
+        const g = decoratorGroups(d.view).find((x) => x.name === fnName && x.kind === 'def');
+        const decoText = g ? g.decos.map((x) => d.view.text.slice(x.start, x.end)).join('\n') : '';
+        const apiView = /@api_view\s*\(\s*\[([^\]]*)\]/.exec(decoText)?.[1];
+        const reqMethods = /@require_http_methods\s*\(\s*[\[(]([^\])]*)[\])]/.exec(decoText)?.[1];
+        const single = /@require_(GET|POST|safe)\b/.exec(decoText)?.[1];
+        const ms = apiView || reqMethods ? [...(apiView ?? reqMethods).matchAll(/['"](\w+)['"]/g)].map((x) => x[1].toUpperCase()) : single ? (single === 'safe' ? ['GET', 'HEAD'] : [single]) : ['ANY'];
+        const deco = g ? g.decos.map((x) => ({ view: d.view, start: x.start, end: x.end, scope: 'router' })) : [];
+        for (const method of ms.length ? ms : ['ANY']) {
+            out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: d.view.file, line: d.view.lines.at(d.start), method, path: full, name: fnName, confidence: 'medium', handlerView: d.view, spec: { start: d.start, end: b.end, seeds: [...pyParams(d.view.masked, d.start), 'request'], decorators: deco, returnsJson: true } }));
+        }
+    };
+    const walk = (file, prefix, seen, list = null) => {
+        const c = confs.get(file);
+        if (!c || (list === null && seen.includes(file)))
+            return;
+        // The top level is urlpatterns, or every pattern outside a named helper list; a helper list is read where an include() names it.
+        const named = new Set(c.patterns.filter((x) => x.includeList).map((x) => x.includeList));
+        for (const p of c.patterns) {
+            if (list === null ? (p.list !== null && p.list !== 'urlpatterns' && named.has(p.list)) : p.list !== list)
+                continue;
+            const joined = joinPath(prefix, p.route);
+            if (p.includeList) {
+                if (!seen.includes(`${file}#${p.includeList}`))
+                    walk(file, joined, [...seen, `${file}#${p.includeList}`], p.includeList);
+                continue;
+            }
+            if (p.includeFile) {
+                walk(p.includeFile, joined, [...seen, file]);
+                continue;
+            }
+            if (p.routerName) {
+                for (const r of c.routers.get(p.routerName) ?? []) {
+                    const found = findClass(repo, r.viewset, file);
+                    if (!found)
+                        continue;
+                    const base = joinPath(joined, r.prefix);
+                    emitClass(repo, found.view, found.at, r.viewset, base, out, true);
+                }
+                continue;
+            }
+            if (!p.viewText)
+                continue;
+            const key = `${file}:${p.line}:${prefix}:${p.route}:${list ?? ''}`;
+            if (emitted.has(key))
+                continue;
+            emitted.add(key);
+            emitView(c, prefix, p, p.viewText, p.route, seen.length);
+        }
+    };
+    for (const r of roots.length ? roots : [...confs.keys()].sort())
+        walk(r, '', []);
+    // REST framework settings that apply to every view.
+    for (const f of repo.filesOf('py')) {
+        if (!/settings/.test(f))
+            continue;
+        const v = repo.view(f);
+        const m = v && /REST_FRAMEWORK\s*=\s*\{/.exec(v.masked);
+        if (!v || !m)
+            continue;
+        const open = v.masked.indexOf('{', m.index);
+        const close = closeOf(v.masked, open);
+        const body = v.text.slice(open, close);
+        const line = v.lines.at(m.index);
+        const protections = [];
+        if (/DEFAULT_PERMISSION_CLASSES[^\]]*IsAuthenticated(?!OrReadOnly)/.test(body))
+            protections.push({ kind: 'session_read', scope: 'global', file: f, line, via: 'DEFAULT_PERMISSION_CLASSES IsAuthenticated', enforced: true, confidence: 'high' });
+        if (/DEFAULT_PERMISSION_CLASSES[^\]]*IsAdminUser/.test(body))
+            protections.push({ kind: 'role_check', scope: 'global', file: f, line, via: 'DEFAULT_PERMISSION_CLASSES IsAdminUser', enforced: true, confidence: 'high' });
+        if (/DEFAULT_THROTTLE_CLASSES/.test(body))
+            protections.push({ kind: 'rate_limit', scope: 'global', file: f, line, via: 'DEFAULT_THROTTLE_CLASSES', enforced: true, confidence: 'high' });
+        if (protections.length)
+            out.gates.push({ id: `${f}:${line}:REST_FRAMEWORK`, kind: 'guard', framework: 'django', file: f, line, paths: ['*'], methods: [], protections, confidence: 'high' });
+    }
+    return out;
+}
+function emitClass(repo, view, at, cls, full, out, viewset = false) {
+    const b = pyBlock(view.masked, view.lines, at);
+    const header = view.masked.slice(at, b.bodyStart);
+    const bases = (/\(([^)]*)\)/.exec(header)?.[1] ?? '').split(',').map((x) => x.trim().split('.').pop()).filter(Boolean);
+    const decos = classDecos(view, cls);
+    const explicit = pyClassMethods(repo, view, cls);
+    const implied = bases.flatMap((x) => GENERIC[x] ?? []);
+    const seen = new Set();
+    const detail = joinPath(full, ':pk');
+    for (const cm of explicit) {
+        const path = viewset && /^(GET|PUT|PATCH|DELETE)$/.test(cm.method) && !/list/i.test(cm.method) ? full : full;
+        out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: cm.view.file, line: cm.view.lines.at(cm.start), method: cm.method, path, name: `${cls}.${cm.method.toLowerCase()}`, confidence: 'medium', handlerView: cm.view, spec: { start: cm.start, end: cm.end, seeds: [...pyParams(cm.view.masked, cm.start), 'request'], decorators: decos, returnsJson: true } }));
+        seen.add(cm.method);
+    }
+    // ViewSet actions (list, create, retrieve, update, partial_update, destroy) defined as methods.
+    if (viewset) {
+        const actions = [['list', 'GET', false], ['create', 'POST', false], ['retrieve', 'GET', true], ['update', 'PUT', true], ['partial_update', 'PATCH', true], ['destroy', 'DELETE', true]];
+        for (const x of view.masked.slice(b.bodyStart, b.end).matchAll(/^[ \t]+(?:async\s+)?def\s+(list|create|retrieve|update|partial_update|destroy)\s*\(/gm)) {
+            const a = actions.find((y) => y[0] === x[1]);
+            const ls = view.masked.lastIndexOf('\n', b.bodyStart + x.index + 1) + 1;
+            const mb = pyBlock(view.masked, view.lines, ls);
+            out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: view.file, line: view.lines.at(ls), method: a[1], path: a[2] ? detail : full, name: `${cls}.${x[1]}`, confidence: 'medium', handlerView: view, spec: { start: ls, end: mb.end, seeds: [...pyParams(view.masked, ls), 'request'], decorators: decos, returnsJson: true } }));
+            seen.add(`${a[1]}:${a[2]}`);
+        }
+        for (const x of view.masked.slice(b.bodyStart, b.end).matchAll(/@action\s*\(([^)]*)\)\s*\n[ \t]*(?:async\s+)?def\s+(\w+)\s*\(/g)) {
+            const ms = /methods\s*=\s*[\[(]([^\])]*)[\])]/.exec(view.text.slice(b.bodyStart + x.index, b.bodyStart + x.index + x[0].length))?.[1];
+            const methods = ms ? [...ms.matchAll(/['"](\w+)['"]/g)].map((y) => y[1].toUpperCase()) : ['GET'];
+            const ls = view.masked.lastIndexOf('\n', b.bodyStart + x.index + x[0].length - 2) + 1;
+            const mb = pyBlock(view.masked, view.lines, ls);
+            const det = /detail\s*=\s*True/.test(view.text.slice(b.bodyStart + x.index, b.bodyStart + x.index + x[0].length));
+            for (const method of methods)
+                out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: view.file, line: view.lines.at(ls), method, path: joinPath(det ? detail : full, x[2]), name: `${cls}.${x[2]}`, confidence: 'medium', handlerView: view, spec: { start: ls, end: mb.end, seeds: [...pyParams(view.masked, ls), 'request'], decorators: decos, returnsJson: true } }));
+        }
+    }
+    // Methods implied by a generic base class (ListCreateAPIView, ModelViewSet ...) that the class does not override.
+    if (viewset && bases.some((x) => GENERIC[x])) {
+        const have = (m, d) => seen.has(`${m}:${d}`);
+        const all = bases.includes('ReadOnlyModelViewSet') ? [['GET', false], ['GET', true]] : [['GET', false], ['POST', false], ['GET', true], ['PUT', true], ['PATCH', true], ['DELETE', true]];
+        const action = (method, det) => (method === 'GET' ? (det ? 'retrieve' : 'list') : method === 'POST' ? 'create' : method === 'PUT' ? 'update' : method === 'PATCH' ? 'partial_update' : 'destroy');
+        for (const [method, det] of all)
+            if (!have(method, det))
+                out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: view.file, line: view.lines.at(at), method, path: det ? detail : full, name: `${cls}.${action(method, det)}`, confidence: 'medium', handlerView: view, spec: { start: at, end: b.end, seeds: ['request'], decorators: decos, returnsJson: true } }));
+    }
+    else if (!viewset) {
+        for (const method of implied)
+            if (!seen.has(method))
+                out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: view.file, line: view.lines.at(at), method, path: full, name: `${cls}.${method.toLowerCase()}`, confidence: 'medium', handlerView: view, spec: { start: at, end: b.end, seeds: ['request'], decorators: decos, returnsJson: true } }));
+    }
+}