hullproof 0.0.0-stage → 0.5.0

package/src/map/mobile.ts

@@ -0,0 +1,263 @@
+// Native mobile configuration (Phase 6f): Android (Kotlin and Java apps) and iOS (Swift and Objective C apps). Level L1 reads the
+// configuration files into the code map: AndroidManifest.xml (components, exported flags, permissions, backup, debuggable and cleartext
+// flags), the network security configuration, Info.plist (App Transport Security, URL schemes, usage descriptions) and the entitlements
+// (associated domains). Level L2 turns what other apps and websites can reach into entry points: exported Android components and deep
+// links, iOS URL schemes and universal links. The Kotlin and Swift source is NOT read here: what a handler does with an incoming intent
+// or URL is not analysed. Pattern based, no XML parser; every fact has the file and line it came from.
+import type { AndroidComponent, AndroidConfig, AndroidFilter, AndroidManifest, ConfigSecret, IosConfig, IosPlist, NetworkSecurity, Protection } from '../types/index.ts';
+import type { FileView } from './analyze.ts';
+import { empty, makeEntry, type Extracted } from './entry.ts';
+import { Lines } from './lex.ts';
+import type { Repo } from './repo.ts';
+
+export interface MobileFacts { android: AndroidConfig | null; ios: IosConfig | null; secrets: ConfigSecret[] }
+
+// Names that say a value is a secret. A key that is public by design (a maps key, a Firebase web key, an analytics id) is not one.
+const SECRET_NAME = /(?:secret|private[_.\- ]?key|passw(?:or)?d|passwd|signing[_.\- ]?key|service[_.\- ]?role|auth[_.\- ]?token|access[_.\- ]?token|refresh[_.\- ]?token)/i;
+const PUBLIC_NAME = /(?:public|publishable|client[_.\- ]?id|maps|geo|analytics|sentry[_.\- ]?dsn)/i;
+const PLACEHOLDER = /^(?:@|\$\(|\$\{|%|<|your[_\- ]|changeme|change[_\- ]me|todo|xxx|null|none|true|false|\s*$)/i;
+export const isSecretValue = (name: string, value: string): boolean => SECRET_NAME.test(name) && !PUBLIC_NAME.test(name) && value.length >= 8 && !PLACEHOLDER.test(value.trim());
+
+const blankComments = (t: string): string => t.replace(/<!--[\s\S]*?-->/g, (c) => c.replace(/[^\n]/g, ' '));
+const view = (file: string, text: string): FileView => ({ file, text, masked: text, lang: 'kt', lines: new Lines(text), imports: '' });
+const bool = (v: string | undefined): boolean | null => (v === 'true' ? true : v === 'false' ? false : null);
+
+interface Tok { name: string; close: boolean; self: boolean; attrs: Record<string, string>; at: number; end: number }
+function tokens(text: string): Tok[] {
+  const out: Tok[] = [];
+  for (const m of text.matchAll(/<(\/?)([A-Za-z_][\w.:-]*)((?:[^>"']|"[^"]*"|'[^']*')*?)(\/?)>/g)) {
+    const attrs: Record<string, string> = {};
+    for (const a of m[3].matchAll(/([\w:.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g)) attrs[a[1]] = a[2] ?? a[3] ?? '';
+    out.push({ name: m[2], close: m[1] === '/', self: m[4] === '/', attrs, at: m.index!, end: m.index! + m[0].length });
+  }
+  return out;
+}
+
+const COMPONENTS = new Set(['activity', 'activity-alias', 'service', 'receiver', 'provider']);
+
+export function readManifest(file: string, text: string, gradleTarget: number | null): { manifest: AndroidManifest; secrets: ConfigSecret[]; bounds: Map<AndroidComponent, [number, number]> } {
+  const clean = blankComments(text);
+  const lines = new Lines(text);
+  const toks = tokens(clean);
+  const secrets: ConfigSecret[] = [];
+  const bounds = new Map<AndroidComponent, [number, number]>();
+  const pkg = toks.find((t) => t.name === 'manifest')?.attrs.package ?? null;
+  const sdk = toks.find((t) => t.name === 'uses-sdk');
+  const targetRaw = sdk?.attrs['android:targetSdkVersion'];
+  const target = targetRaw && /^\d+$/.test(targetRaw) ? Number(targetRaw) : gradleTarget;
+  const app = toks.find((t) => t.name === 'application' && !t.close);
+  const manifest: AndroidManifest = {
+    file, package: pkg, line: lines.at(app?.at ?? 0), debuggable: bool(app?.attrs['android:debuggable']), allow_backup: bool(app?.attrs['android:allowBackup']),
+    uses_cleartext_traffic: bool(app?.attrs['android:usesCleartextTraffic']), network_security_config: app?.attrs['android:networkSecurityConfig'] ?? null,
+    target_sdk: target, permissions: toks.filter((t) => t.name === 'uses-permission' && !t.close).map((t) => t.attrs['android:name']).filter(Boolean).sort(), components: [],
+  };
+  let cur: AndroidComponent | null = null;
+  let curStart = 0;
+  let filter: AndroidFilter | null = null;
+  let hasFilter = false;
+  const finish = (endAt: number): void => {
+    if (!cur) return;
+    // A component with an intent filter and no explicit flag is exported before Android 12 (target SDK 31).
+    if (!cur.exported_explicit) cur.exported = hasFilter && (target === null || target < 31);
+    bounds.set(cur, [curStart, endAt]);
+    manifest.components.push(cur);
+    cur = null;
+  };
+  for (const t of toks) {
+    if (t.name === 'meta-data' && !t.close) {
+      const n = t.attrs['android:name'] ?? '';
+      const v = t.attrs['android:value'] ?? '';
+      if (isSecretValue(n, v)) secrets.push({ file, line: lines.at(t.at), key: n, where: 'android manifest' });
+      continue;
+    }
+    if (COMPONENTS.has(t.name)) {
+      if (t.close) { finish(t.end); continue; }
+      finish(t.at);
+      const nm = t.attrs['android:name'] ?? '';
+      const full = nm.startsWith('.') ? `${pkg ?? ''}${nm}` : nm.includes('.') ? nm : `${pkg ?? ''}.${nm}`;
+      const perm = t.attrs['android:permission'] ?? t.attrs['android:readPermission'] ?? t.attrs['android:writePermission'] ?? null;
+      const ex = t.attrs['android:exported'];
+      cur = { kind: t.name === 'activity-alias' ? 'activity' : (t.name as AndroidComponent['kind']), name: full, line: lines.at(t.at), exported: ex === 'true', exported_explicit: ex !== undefined, permission: perm, launcher: false, filters: [] };
+      curStart = t.at;
+      hasFilter = false;
+      if (t.self) finish(t.end);
+      continue;
+    }
+    if (!cur) continue;
+    if (t.name === 'intent-filter') { if (t.close) { if (filter) cur.filters.push(filter); filter = null; } else { filter = { actions: [], categories: [], schemes: [], hosts: [], paths: [] }; hasFilter = true; } continue; }
+    if (!filter || t.close) continue;
+    if (t.name === 'action') filter.actions.push(t.attrs['android:name'] ?? '');
+    else if (t.name === 'category') filter.categories.push(t.attrs['android:name'] ?? '');
+    else if (t.name === 'data') {
+      const a = t.attrs;
+      if (a['android:scheme']) filter.schemes.push(a['android:scheme']);
+      if (a['android:host']) filter.hosts.push(a['android:host']);
+      const p = a['android:path'] ?? a['android:pathPrefix'] ?? a['android:pathPattern'] ?? a['android:pathAdvancedPattern'];
+      if (p) filter.paths.push(p);
+    }
+  }
+  finish(clean.length);
+  for (const c of manifest.components) c.launcher = c.filters.length > 0 && c.filters.every((f) => f.actions.every((a) => a === 'android.intent.action.MAIN') && f.categories.includes('android.intent.category.LAUNCHER'));
+  for (const c of manifest.components) { c.filters.forEach((f) => { f.actions.sort(); f.categories.sort(); f.schemes.sort(); f.hosts.sort(); f.paths.sort(); }); }
+  manifest.components.sort((a, b) => a.line - b.line || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+  return { manifest, secrets, bounds };
+}
+
+export function readNetworkSecurity(file: string, text: string): NetworkSecurity {
+  const clean = blankComments(text);
+  const lines = new Lines(text);
+  const toks = tokens(clean);
+  const base = toks.find((t) => t.name === 'base-config' && !t.close);
+  const domains: string[] = [];
+  let pins = 0;
+  let inDomainConfig: Tok | null = null;
+  let userCerts = false;
+  let cleartextDomains: string[] = [];
+  const pending: string[] = [];
+  for (const t of toks) {
+    if (t.name === 'domain-config') {
+      if (t.close) { if (inDomainConfig?.attrs.cleartextTrafficPermitted === 'true') cleartextDomains = cleartextDomains.concat(pending); pending.length = 0; inDomainConfig = null; } else { inDomainConfig = t; pending.length = 0; }
+    } else if (t.name === 'domain' && !t.close && inDomainConfig) { const d = clean.slice(t.end, clean.indexOf('<', t.end)).trim(); if (d) { domains.push(d); pending.push(d); } }
+    else if (t.name === 'pin' && !t.close) pins++;
+    else if (t.name === 'certificates' && t.attrs.src === 'user') userCerts = true;
+  }
+  return { file, line: lines.at(base?.at ?? 0), cleartext_base: bool(base?.attrs.cleartextTrafficPermitted), cleartext_domains: cleartextDomains.sort(), trusts_user_certs: userCerts, pinned_domains: pins };
+}
+
+// ---- Info.plist and entitlements -------------------------------------------------------------------------------------------------
+type PVal = string | boolean | number | PVal[] | { [k: string]: PVal };
+interface PlistRead { value: { [k: string]: PVal }; keyLines: Map<string, number> }
+function readPlist(text: string): PlistRead | null {
+  const lines = new Lines(text);
+  const toks = [...blankComments(text).matchAll(/<(\/?)(dict|array|key|string|integer|real|true|false|data|date)\b[^>]*?(\/?)>/g)];
+  let i = 0;
+  const keyLines = new Map<string, number>();
+  const textAfter = (m: RegExpMatchArray): string => text.slice(m.index! + m[0].length, text.indexOf('<', m.index! + m[0].length));
+  const value = (): PVal => {
+    const t = toks[i++];
+    if (!t) return '';
+    if (t[2] === 'true') return true;
+    if (t[2] === 'false') return false;
+    if (t[2] === 'string' || t[2] === 'data' || t[2] === 'date') { const v = t[3] === '/' ? '' : textAfter(t); if (t[3] !== '/') i++; return v; }
+    if (t[2] === 'integer' || t[2] === 'real') { const v = Number(textAfter(t)); i++; return v; }
+    if (t[2] === 'array') { const a: PVal[] = []; while (i < toks.length && !(toks[i][1] === '/' && toks[i][2] === 'array')) a.push(value()); i++; return a; }
+    if (t[2] === 'dict') {
+      const d: { [k: string]: PVal } = {};
+      while (i < toks.length && !(toks[i][1] === '/' && toks[i][2] === 'dict')) {
+        const k = toks[i];
+        if (k[2] !== 'key' || k[1] === '/') { i++; continue; }
+        const name = textAfter(k);
+        keyLines.set(name, lines.at(k.index!));
+        i += 2;
+        d[name] = value();
+      }
+      i++;
+      return d;
+    }
+    return '';
+  };
+  const start = toks.findIndex((t) => t[2] === 'dict' && t[1] !== '/');
+  if (start < 0) return null;
+  i = start;
+  const v = value();
+  return typeof v === 'object' && !Array.isArray(v) ? { value: v, keyLines } : null;
+}
+
+const strList = (v: PVal | undefined): string[] => (Array.isArray(v) ? v.filter((x): x is string => typeof x === 'string') : []);
+
+export function readPlistFile(file: string, text: string): { plist: IosPlist; secrets: ConfigSecret[]; urlSchemes: { scheme: string; line: number }[]; domains: { domain: string; line: number }[] } | null {
+  const r = readPlist(text);
+  if (!r) return null;
+  const d = r.value;
+  const ats = typeof d.NSAppTransportSecurity === 'object' && !Array.isArray(d.NSAppTransportSecurity) ? (d.NSAppTransportSecurity as { [k: string]: PVal }) : null;
+  const secrets: ConfigSecret[] = [];
+  for (const [k, v] of Object.entries(d)) if (typeof v === 'string' && isSecretValue(k, v)) secrets.push({ file, line: r.keyLines.get(k) ?? 1, key: k, where: 'ios plist' });
+  const types = Array.isArray(d.CFBundleURLTypes) ? d.CFBundleURLTypes : [];
+  const schemes = types.flatMap((t) => (typeof t === 'object' && !Array.isArray(t) ? strList((t as { [k: string]: PVal }).CFBundleURLSchemes) : []));
+  const line = r.keyLines.get('CFBundleURLTypes') ?? 1;
+  const assoc = strList(d['com.apple.developer.associated-domains']).filter((x) => x.startsWith('applinks:')).map((x) => x.slice('applinks:'.length).replace(/\?.*$/, ''));
+  return {
+    plist: {
+      file, ats_arbitrary_loads: ats && typeof ats.NSAllowsArbitraryLoads === 'boolean' ? (ats.NSAllowsArbitraryLoads as boolean) : null, ats_line: r.keyLines.get('NSAllowsArbitraryLoads') ?? null,
+      url_schemes: schemes.slice().sort(), associated_domains: assoc.slice().sort(), usage_descriptions: Object.keys(d).filter((k) => /UsageDescription$/.test(k)).sort(),
+    },
+    secrets, urlSchemes: schemes.map((scheme) => ({ scheme, line })), domains: assoc.map((domain) => ({ domain, line: r.keyLines.get('com.apple.developer.associated-domains') ?? 1 })),
+  };
+}
+
+const SKIP = /(?:^|\/)(?:Pods|Carthage|\.build|DerivedData|node_modules|build|intermediates)\//;
+
+export function mobileFiles(repo: Repo): { manifests: string[]; plists: string[]; netsec: string[]; strings: string[] } {
+  const f = repo.ctx.files.filter((x) => !SKIP.test(x));
+  return {
+    manifests: f.filter((x) => /(?:^|\/)AndroidManifest\.xml$/.test(x) && !/\/build\//.test(x)),
+    netsec: f.filter((x) => /(?:^|\/)res\/xml\/[\w-]*network_security_config\w*\.xml$/.test(x)),
+    strings: f.filter((x) => /(?:^|\/)res\/values[\w-]*\/strings\.xml$/.test(x)),
+    plists: f.filter((x) => /(?:^|\/)Info\.plist$|\.entitlements$/.test(x)),
+  };
+}
+
+const gradleTarget = (repo: Repo): number | null => {
+  for (const f of repo.ctx.files.filter((x) => /(?:^|\/)build\.gradle(?:\.kts)?$/.test(x))) {
+    const m = /\btargetSdk(?:Version)?\s*[= ]\s*(\d+)/.exec(repo.ctx.text(f));
+    if (m) return Number(m[1]);
+  }
+  return null;
+};
+
+export function mobileFacts(repo: Repo): MobileFacts {
+  const files = mobileFiles(repo);
+  const secrets: ConfigSecret[] = [];
+  let android: AndroidConfig | null = null;
+  if (files.manifests.length || files.netsec.length) {
+    const target = gradleTarget(repo);
+    android = { manifests: [], network_security: files.netsec.map((f) => readNetworkSecurity(f, repo.ctx.text(f))) };
+    for (const f of files.manifests) { const r = readManifest(f, repo.ctx.text(f), target); android.manifests.push(r.manifest); secrets.push(...r.secrets); }
+    for (const f of files.strings) {
+      const t = repo.ctx.text(f);
+      const lines = new Lines(t);
+      for (const m of blankComments(t).matchAll(/<string\s+name="([^"]+)"[^>]*>([^<]*)<\/string>/g)) if (isSecretValue(m[1], m[2])) secrets.push({ file: f, line: lines.at(m.index!), key: m[1], where: 'android strings' });
+    }
+  }
+  let ios: IosConfig | null = null;
+  const plists = files.plists.map((f) => ({ f, r: readPlistFile(f, repo.ctx.text(f)) })).filter((x) => x.r !== null);
+  if (plists.length) { ios = { plists: plists.map((x) => x.r!.plist) }; for (const x of plists) secrets.push(...x.r!.secrets); }
+  const sorted = secrets.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : 0) || a.line - b.line || (a.key < b.key ? -1 : 1));
+  return { android, ios, secrets: sorted };
+}
+
+// ---- entry points -----------------------------------------------------------------------------------------------------------------
+export function extractMobile(repo: Repo): Extracted {
+  const out = empty();
+  const files = mobileFiles(repo);
+  const target = gradleTarget(repo);
+  for (const f of files.manifests) {
+    const text = repo.ctx.text(f);
+    const v = view(f, text);
+    const { manifest, bounds } = readManifest(f, text, target);
+    for (const c of manifest.components) {
+      if (!c.exported || c.launcher) continue;
+      const [s, e] = bounds.get(c) ?? [0, 0];
+      const prot: Protection[] = c.permission ? [{ kind: 'role_check', scope: 'handler', file: f, line: c.line, via: `android:permission ${c.permission}`, enforced: true, confidence: 'high' }] : [];
+      const analysis = { protections: prot, reads: [], data: [], outbound: [], taint: { names: new Set<string>(), validated: new Set<string>(), trusted: new Set<string>() } };
+      const links = c.filters.filter((x) => x.actions.includes('android.intent.action.VIEW') && x.categories.includes('android.intent.category.BROWSABLE') && x.schemes.length);
+      if (c.kind === 'activity' && links.length) {
+        const names = new Set<string>();
+        for (const fl of links) for (const sc of fl.schemes) for (const h of fl.hosts.length ? fl.hosts : ['']) for (const p of fl.paths.length ? fl.paths : ['']) names.add(`${sc}://${h}${p}`);
+        for (const n of [...names].sort()) out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'android', file: f, line: c.line, method: null, path: null, name: n, confidence: 'high', handlerView: v, spec: { start: s, end: e, seeds: [] }, analysis, tags: ['public'] }));
+        continue;
+      }
+      out.entries.push(makeEntry(repo, { kind: 'ipc', framework: 'android', file: f, line: c.line, method: null, path: null, name: c.name, confidence: c.exported_explicit ? 'high' : 'medium', handlerView: v, spec: { start: s, end: e, seeds: [] }, analysis }));
+    }
+  }
+  for (const f of files.plists) {
+    const text = repo.ctx.text(f);
+    const r = readPlistFile(f, text);
+    if (!r) continue;
+    const v = view(f, text);
+    const analysis = { protections: [] as Protection[], reads: [], data: [], outbound: [], taint: { names: new Set<string>(), validated: new Set<string>(), trusted: new Set<string>() } };
+    for (const u of r.urlSchemes) out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'ios', file: f, line: u.line, method: null, path: null, name: `${u.scheme}://`, confidence: 'high', handlerView: v, spec: { start: 0, end: 0, seeds: [] }, analysis, tags: ['public'] }));
+    for (const d of r.domains) out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'ios', file: f, line: d.line, method: null, path: null, name: `https://${d.domain}/`, confidence: 'high', handlerView: v, spec: { start: 0, end: 0, seeds: [] }, analysis, tags: ['public'] }));
+  }
+  return out;
+}

package/src/map/py-django.ts

@@ -0,0 +1,239 @@
+// Django and Django REST framework entry points. Repository level: the URL configuration is read from the root down, so a
+// view's full path includes the prefixes of every include() above it.
+import type { Gate, Protection } from '../types/index.ts';
+import type { FileView, Spec } from './analyze.ts';
+import { empty, joinPath, makeEntry, normPath, type Extracted } from './entry.ts';
+import { closeOf, pyBlock, splitArgs } from './lex.ts';
+import { classDecos, decoratorGroups, pyParams, pyClassMethods, resolvePyModule } from './py.ts';
+import type { Repo } from './repo.ts';
+
+interface Pattern { route: string; viewText: string; line: number; includeFile: string | null; routerName: string | null; list: string | null; includeList: string | null }
+interface UrlConf { file: string; view: FileView; patterns: Pattern[]; routers: Map<string, { prefix: string; viewset: string; line: number }[]> }
+
+const GENERIC: Record<string, string[]> = {
+  ListAPIView: ['GET'], CreateAPIView: ['POST'], RetrieveAPIView: ['GET'], UpdateAPIView: ['PUT', 'PATCH'], DestroyAPIView: ['DELETE'],
+  ListCreateAPIView: ['GET', 'POST'], RetrieveUpdateAPIView: ['GET', 'PUT', 'PATCH'], RetrieveDestroyAPIView: ['GET', 'DELETE'],
+  RetrieveUpdateDestroyAPIView: ['GET', 'PUT', 'PATCH', 'DELETE'], ModelViewSet: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
+  ReadOnlyModelViewSet: ['GET'], ListModelMixin: ['GET'], CreateModelMixin: ['POST'], DestroyModelMixin: ['DELETE'],
+};
+
+const routeText = (t: string): string | null => /^\s*[rRuU]?(['"])((?:\\.|(?!\1).)*)\1/.exec(t)?.[2] ?? null;
+const cleanRoute = (r: string): string => normPath(r.replace(/^\^/, '').replace(/\$$/, '').replace(/\(\?P<(\w+)>[^)]*\)/g, ':$1').replace(/\\\//g, '/'));
+
+function parseUrlConf(repo: Repo, v: FileView): UrlConf | null {
+  if (!/\burlpatterns\b/.test(v.masked)) return null;
+  const conf: UrlConf = { file: v.file, view: v, patterns: [], routers: new Map() };
+  // Lists of patterns defined in this file (api_urls = [...]): a pattern belongs to the innermost list that holds it.
+  const lists: { name: string; from: number; to: number }[] = [];
+  for (const l of v.masked.matchAll(/^(\w+)\s*(?::[^=\n]+)?=\s*\[/gm)) { const open = l.index! + l[0].length - 1; const close = closeOf(v.masked, open); if (close > 0) lists.push({ name: l[1], from: open, to: close }); }
+  for (const m of v.masked.matchAll(/(?<![\w.])(path|re_path|url)\s*\(/g)) {
+    const open = m.index! + m[0].length - 1;
+    const args = splitArgs(v.masked, open);
+    if (args.length < 2) continue;
+    const route = routeText(v.text.slice(args[0].start, args[0].end));
+    if (route === null) continue;
+    const viewText = v.text.slice(args[1].start, args[1].end);
+    const inc = /^include\s*\(\s*([\s\S]*)\)\s*$/.exec(viewText);
+    let includeFile: string | null = null;
+    let routerName: string | null = null;
+    let includeList: string | null = null;
+    if (inc) {
+      const lit = /^\(?\s*['"]([\w.]+)['"]/.exec(inc[1])?.[1];
+      const rn = /^(\w+)\.urls/.exec(inc[1])?.[1];
+      const own = /^\(?\s*(\w+)\s*\)?\s*$/.exec(inc[1])?.[1];
+      if (own && lists.some((x) => x.name === own)) includeList = own;
+      else if (lit) includeFile = resolvePyModule(repo, v.file, lit);
+      else if (rn) routerName = rn;
+      else { const id = /^\(?\s*(\w+)/.exec(inc[1])?.[1]; if (id) { const imp = [...v.text.matchAll(new RegExp(`from\\s+([\\w.]+)\\s+import\\s+[^\\n]*\\b${id}\\b`, 'g'))][0]; includeFile = resolvePyModule(repo, v.file, imp ? `${imp[1]}.${id}` : id) ?? (imp ? resolvePyModule(repo, v.file, imp[1]) : null); } }
+    }
+    const holder = lists.filter((x) => m.index! > x.from && m.index! < x.to).sort((a, b) => (a.to - a.from) - (b.to - b.from))[0];
+    conf.patterns.push({ route: cleanRoute(route), viewText: inc ? '' : viewText, line: v.lines.at(m.index!), includeFile, routerName, list: holder?.name ?? null, includeList });
+  }
+  for (const m of v.masked.matchAll(/\b(\w+)\.register\s*\(/g)) {
+    const open = m.index! + m[0].length - 1;
+    const args = splitArgs(v.masked, open);
+    if (args.length < 2) continue;
+    const prefix = routeText(v.text.slice(args[0].start, args[0].end));
+    const vs = /^[A-Za-z_][\w.]*/.exec(v.text.slice(args[1].start, args[1].end))?.[0];
+    if (prefix === null || !vs) continue;
+    const list = conf.routers.get(m[1]) ?? [];
+    list.push({ prefix: cleanRoute(prefix), viewset: vs.split('.').pop()!, line: v.lines.at(m.index!) });
+    conf.routers.set(m[1], list);
+  }
+  return conf;
+}
+
+// The function a url pattern names. A dotted reference (views.add) is followed through the import in the url file, a bare name through
+// "from x import name", and otherwise a def of that name in a views module wins over one in a model, an admin class or a command.
+function pickView(repo: Repo, urls: FileView, expr: string, fnName: string): ReturnType<Repo['defs']>[number] | undefined {
+  const defs = repo.defs('py', fnName);
+  if (defs.length <= 1) return defs[0];
+  const ref = /^([\w.]+)/.exec(expr)?.[1] ?? fnName;
+  const parts = ref.split('.');
+  let file: string | null = null;
+  if (parts.length > 1) {
+    const mod = parts[parts.length - 2];
+    const imp = new RegExp(`from\\s+([.\\w]+)\\s+import\\s+(?:[^\\n]*,\\s*)?${mod}\\b|import\\s+([.\\w]+)\\s+as\\s+${mod}\\b`).exec(urls.text);
+    if (imp) file = imp[2] ? resolvePyModule(repo, urls.file, imp[2]) : (resolvePyModule(repo, urls.file, `${imp[1].replace(/\.$/, '')}.${mod}`) ?? resolvePyModule(repo, urls.file, imp[1]));
+  } else {
+    const imp = new RegExp(`from\\s+([.\\w]+)\\s+import\\s+[^\\n]*\\b${fnName}\\b`).exec(urls.text);
+    if (imp) file = resolvePyModule(repo, urls.file, imp[1]);
+  }
+  const hit = file ? defs.filter((x) => x.view.file === file) : [];
+  if (hit.length) return hit[0];
+  const dir = urls.file.includes('/') ? urls.file.slice(0, urls.file.lastIndexOf('/') + 1) : '';
+  const rank = (f: string): number => (/(?:^|\/)views?(?:\/|\.py$|_)/.test(f) ? 0 : f.startsWith(dir) ? 1 : 2) + (/(?:admin|models?|management|tests?)(?:\/|\.py$)/.test(f) ? 3 : 0);
+  return defs.slice().sort((a, b) => rank(a.view.file) - rank(b.view.file))[0];
+}
+
+function findClass(repo: Repo, name: string, near: string): { view: FileView; at: number } | null {
+  const files = [near, ...repo.filesOf('py').filter((f) => f !== near)];
+  for (const f of files) {
+    const view = repo.view(f);
+    if (!view) continue;
+    const m = new RegExp(`^class\\s+${name}\\b[^\\n]*:`, 'm').exec(view.masked);
+    if (m) return { view, at: m.index };
+  }
+  return null;
+}
+
+export function extractDjango(repo: Repo): Extracted {
+  const out = empty();
+  const confs = new Map<string, UrlConf>();
+  for (const f of repo.filesOf('py')) {
+    if (!/urls?\.py$|urlconf|routing|routes/.test(f) && !/urlpatterns/.test(repo.ctx.text(f))) continue;
+    const v = repo.view(f);
+    const c = v ? parseUrlConf(repo, v) : null;
+    if (c) confs.set(f, c);
+  }
+  if (!confs.size) return out;
+  const included = new Set<string>();
+  for (const c of confs.values()) for (const p of c.patterns) if (p.includeFile) included.add(p.includeFile);
+  const roots = [...confs.keys()].filter((f) => !included.has(f)).sort();
+  const emitted = new Set<string>();
+
+  const emitView = (c: UrlConf, prefix: string, p: Pattern, viewExpr: string, route: string, depth: number): void => {
+    void depth;
+    const full = joinPath(prefix, route);
+    const v = c.view;
+    if (/admin\.site\.urls/.test(viewExpr)) {
+      const e = makeEntry(repo, { kind: 'http_route', framework: 'django-admin', file: v.file, line: p.line, method: 'ANY', path: joinPath(full, '*'), name: 'django admin', confidence: 'medium', handlerView: v, spec: { start: 0, end: 0, seeds: [], decorators: [], returnsJson: false }, tags: ['admin'] });
+      e.protections.push({ kind: 'session_read', scope: 'global', file: v.file, line: p.line, via: 'django admin site login', enforced: true, confidence: 'high' }, { kind: 'role_check', scope: 'global', file: v.file, line: p.line, via: 'django admin is_staff', enforced: true, confidence: 'high' });
+      out.entries.push(e);
+      return;
+    }
+    const asView = /^([\w.]+?)\.as_view\s*\(/.exec(viewExpr);
+    if (asView) {
+      const cls = asView[1].split('.').pop()!;
+      const found = findClass(repo, cls, v.file);
+      if (!found) return;
+      emitClass(repo, found.view, found.at, cls, full, out);
+      return;
+    }
+    const fnName = /^([\w.]+)\s*(?:,|$)/.exec(viewExpr.trim())?.[1]?.split('.').pop();
+    if (!fnName) return;
+    const d = pickView(repo, v, viewExpr.trim(), fnName);
+    if (!d) return;
+    const b = pyBlock(d.view.masked, d.view.lines, d.start);
+    const g = decoratorGroups(d.view).find((x) => x.name === fnName && x.kind === 'def');
+    const decoText = g ? g.decos.map((x) => d.view.text.slice(x.start, x.end)).join('\n') : '';
+    const apiView = /@api_view\s*\(\s*\[([^\]]*)\]/.exec(decoText)?.[1];
+    const reqMethods = /@require_http_methods\s*\(\s*[\[(]([^\])]*)[\])]/.exec(decoText)?.[1];
+    const single = /@require_(GET|POST|safe)\b/.exec(decoText)?.[1];
+    const ms = apiView || reqMethods ? [...(apiView ?? reqMethods)!.matchAll(/['"](\w+)['"]/g)].map((x) => x[1].toUpperCase()) : single ? (single === 'safe' ? ['GET', 'HEAD'] : [single]) : ['ANY'];
+    const deco: NonNullable<Spec['decorators']> = g ? g.decos.map((x) => ({ view: d.view, start: x.start, end: x.end, scope: 'router' as const })) : [];
+    for (const method of ms.length ? ms : ['ANY']) {
+      out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: d.view.file, line: d.view.lines.at(d.start), method, path: full, name: fnName, confidence: 'medium', handlerView: d.view, spec: { start: d.start, end: b.end, seeds: [...pyParams(d.view.masked, d.start), 'request'], decorators: deco, returnsJson: true } }));
+    }
+  };
+
+  const walk = (file: string, prefix: string, seen: string[], list: string | null = null): void => {
+    const c = confs.get(file);
+    if (!c || (list === null && seen.includes(file))) return;
+    // The top level is urlpatterns, or every pattern outside a named helper list; a helper list is read where an include() names it.
+    const named = new Set(c.patterns.filter((x) => x.includeList).map((x) => x.includeList));
+    for (const p of c.patterns) {
+      if (list === null ? (p.list !== null && p.list !== 'urlpatterns' && named.has(p.list)) : p.list !== list) continue;
+      const joined = joinPath(prefix, p.route);
+      if (p.includeList) { if (!seen.includes(`${file}#${p.includeList}`)) walk(file, joined, [...seen, `${file}#${p.includeList}`], p.includeList); continue; }
+      if (p.includeFile) { walk(p.includeFile, joined, [...seen, file]); continue; }
+      if (p.routerName) {
+        for (const r of c.routers.get(p.routerName) ?? []) {
+          const found = findClass(repo, r.viewset, file);
+          if (!found) continue;
+          const base = joinPath(joined, r.prefix);
+          emitClass(repo, found.view, found.at, r.viewset, base, out, true);
+        }
+        continue;
+      }
+      if (!p.viewText) continue;
+      const key = `${file}:${p.line}:${prefix}:${p.route}:${list ?? ''}`;
+      if (emitted.has(key)) continue;
+      emitted.add(key);
+      emitView(c, prefix, p, p.viewText, p.route, seen.length);
+    }
+  };
+  for (const r of roots.length ? roots : [...confs.keys()].sort()) walk(r, '', []);
+
+  // REST framework settings that apply to every view.
+  for (const f of repo.filesOf('py')) {
+    if (!/settings/.test(f)) continue;
+    const v = repo.view(f);
+    const m = v && /REST_FRAMEWORK\s*=\s*\{/.exec(v.masked);
+    if (!v || !m) continue;
+    const open = v.masked.indexOf('{', m.index);
+    const close = closeOf(v.masked, open);
+    const body = v.text.slice(open, close);
+    const line = v.lines.at(m.index);
+    const protections: Protection[] = [];
+    if (/DEFAULT_PERMISSION_CLASSES[^\]]*IsAuthenticated(?!OrReadOnly)/.test(body)) protections.push({ kind: 'session_read', scope: 'global', file: f, line, via: 'DEFAULT_PERMISSION_CLASSES IsAuthenticated', enforced: true, confidence: 'high' });
+    if (/DEFAULT_PERMISSION_CLASSES[^\]]*IsAdminUser/.test(body)) protections.push({ kind: 'role_check', scope: 'global', file: f, line, via: 'DEFAULT_PERMISSION_CLASSES IsAdminUser', enforced: true, confidence: 'high' });
+    if (/DEFAULT_THROTTLE_CLASSES/.test(body)) protections.push({ kind: 'rate_limit', scope: 'global', file: f, line, via: 'DEFAULT_THROTTLE_CLASSES', enforced: true, confidence: 'high' });
+    if (protections.length) out.gates.push({ id: `${f}:${line}:REST_FRAMEWORK`, kind: 'guard', framework: 'django', file: f, line, paths: ['*'], methods: [], protections, confidence: 'high' } as Gate);
+  }
+  return out;
+}
+
+function emitClass(repo: Repo, view: FileView, at: number, cls: string, full: string, out: Extracted, viewset = false): void {
+  const b = pyBlock(view.masked, view.lines, at);
+  const header = view.masked.slice(at, b.bodyStart);
+  const bases = (/\(([^)]*)\)/.exec(header)?.[1] ?? '').split(',').map((x) => x.trim().split('.').pop()!).filter(Boolean);
+  const decos = classDecos(view, cls);
+  const explicit = pyClassMethods(repo, view, cls);
+  const implied = bases.flatMap((x) => GENERIC[x] ?? []);
+  const seen = new Set<string>();
+  const detail = joinPath(full, ':pk');
+  for (const cm of explicit) {
+    const path = viewset && /^(GET|PUT|PATCH|DELETE)$/.test(cm.method) && !/list/i.test(cm.method) ? full : full;
+    out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: cm.view.file, line: cm.view.lines.at(cm.start), method: cm.method, path, name: `${cls}.${cm.method.toLowerCase()}`, confidence: 'medium', handlerView: cm.view, spec: { start: cm.start, end: cm.end, seeds: [...pyParams(cm.view.masked, cm.start), 'request'], decorators: decos, returnsJson: true } }));
+    seen.add(cm.method);
+  }
+  // ViewSet actions (list, create, retrieve, update, partial_update, destroy) defined as methods.
+  if (viewset) {
+    const actions: [string, string, boolean][] = [['list', 'GET', false], ['create', 'POST', false], ['retrieve', 'GET', true], ['update', 'PUT', true], ['partial_update', 'PATCH', true], ['destroy', 'DELETE', true]];
+    for (const x of view.masked.slice(b.bodyStart, b.end).matchAll(/^[ \t]+(?:async\s+)?def\s+(list|create|retrieve|update|partial_update|destroy)\s*\(/gm)) {
+      const a = actions.find((y) => y[0] === x[1])!;
+      const ls = view.masked.lastIndexOf('\n', b.bodyStart + x.index! + 1) + 1;
+      const mb = pyBlock(view.masked, view.lines, ls);
+      out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: view.file, line: view.lines.at(ls), method: a[1], path: a[2] ? detail : full, name: `${cls}.${x[1]}`, confidence: 'medium', handlerView: view, spec: { start: ls, end: mb.end, seeds: [...pyParams(view.masked, ls), 'request'], decorators: decos, returnsJson: true } }));
+      seen.add(`${a[1]}:${a[2]}`);
+    }
+    for (const x of view.masked.slice(b.bodyStart, b.end).matchAll(/@action\s*\(([^)]*)\)\s*\n[ \t]*(?:async\s+)?def\s+(\w+)\s*\(/g)) {
+      const ms = /methods\s*=\s*[\[(]([^\])]*)[\])]/.exec(view.text.slice(b.bodyStart + x.index!, b.bodyStart + x.index! + x[0].length))?.[1];
+      const methods = ms ? [...ms.matchAll(/['"](\w+)['"]/g)].map((y) => y[1].toUpperCase()) : ['GET'];
+      const ls = view.masked.lastIndexOf('\n', b.bodyStart + x.index! + x[0].length - 2) + 1;
+      const mb = pyBlock(view.masked, view.lines, ls);
+      const det = /detail\s*=\s*True/.test(view.text.slice(b.bodyStart + x.index!, b.bodyStart + x.index! + x[0].length));
+      for (const method of methods) out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: view.file, line: view.lines.at(ls), method, path: joinPath(det ? detail : full, x[2]), name: `${cls}.${x[2]}`, confidence: 'medium', handlerView: view, spec: { start: ls, end: mb.end, seeds: [...pyParams(view.masked, ls), 'request'], decorators: decos, returnsJson: true } }));
+    }
+  }
+  // Methods implied by a generic base class (ListCreateAPIView, ModelViewSet ...) that the class does not override.
+  if (viewset && bases.some((x) => GENERIC[x])) {
+    const have = (m: string, d: boolean): boolean => seen.has(`${m}:${d}`);
+    const all: [string, boolean][] = bases.includes('ReadOnlyModelViewSet') ? [['GET', false], ['GET', true]] : [['GET', false], ['POST', false], ['GET', true], ['PUT', true], ['PATCH', true], ['DELETE', true]];
+    const action = (method: string, det: boolean): string => (method === 'GET' ? (det ? 'retrieve' : 'list') : method === 'POST' ? 'create' : method === 'PUT' ? 'update' : method === 'PATCH' ? 'partial_update' : 'destroy');
+    for (const [method, det] of all) if (!have(method, det)) out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: view.file, line: view.lines.at(at), method, path: det ? detail : full, name: `${cls}.${action(method, det)}`, confidence: 'medium', handlerView: view, spec: { start: at, end: b.end, seeds: ['request'], decorators: decos, returnsJson: true } }));
+  } else if (!viewset) {
+    for (const method of implied) if (!seen.has(method)) out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'django', file: view.file, line: view.lines.at(at), method, path: full, name: `${cls}.${method.toLowerCase()}`, confidence: 'medium', handlerView: view, spec: { start: at, end: b.end, seeds: ['request'], decorators: decos, returnsJson: true } }));
+  }
+}