attackmap-analyzer-php-web 0.1.0__tar.gz

attackmap_analyzer_php_web-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_php_web-0.1.0/PKG-INFO

@@ -0,0 +1,133 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-php-web
+Version: 0.1.0
+Summary: Broad PHP web analyzer plugin for AttackMap
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-php-web
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-php-web
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-php-web/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-php-web/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-php-web
+
+Broad PHP web analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This repository is intentionally separate from AttackMap core. It focuses only on extracting structured signals from PHP repositories:
+
+- routes
+- outbound HTTP calls
+- datastore hints
+- auth hints
+- secret and env usage
+
+It does not render reports and does not own global severity policy.
+
+## Analyzer identity
+
+- `name`: `php-web`
+- `display_name`: `PHP Web Analyzer`
+- `version`: `0.1.0`
+- `experimental`: `true`
+- `enabled_by_default`: `false`
+
+## Scope
+
+This analyzer is broad and heuristic. It is meant to map common PHP web application surfaces before framework-specific analyzers (for example `php-laminas` or `omeka-s`) are added.
+
+## Detection strategy
+
+`detect(repo_path)` uses lightweight signals:
+
+- `composer.json` present
+- at least one `.php` file
+- common PHP app layout (`src/`, `app/`, `module/`, `public/`)
+
+## Extraction strategy
+
+`analyze(repo_path)` scans `.php` files and emits structured signals using regular-expression heuristics.
+
+Route extraction currently includes patterns such as:
+
+- `Route::get(...)`/`Route::post(...)` style calls
+- `$app->get(...)` style calls
+- PHP attributes like `#[Route("/path", methods: ["GET"]) ]`
+- basic config-style `"path" => "/..."`
+
+Outbound calls currently include patterns such as:
+
+- `curl_init("https://...")`
+- `file_get_contents("https://...")`
+- common HTTP client calls such as `->request(...)`, `->get(...)`, `->post(...)`
+
+Datastore/auth/secret hints are similarly heuristic and intended as first-pass signals.
+
+## Installation
+
+```bash
+pip install attackmap-analyzer-php-web
+```
+
+For local development:
+
+```bash
+pip install -e .[dev]
+```
+
+## Contract alignment with AttackMap core
+
+This package targets the current AttackMap analyzer contract:
+
+- analyzer exposes metadata via `metadata`
+- analyzer implements `detect(repo_path)` and `analyze(repo_path)`
+- `analyze` returns AttackMap-style structured scan data (`ScanResult` shape)
+
+The package includes a small compatibility layer so tests can run even if AttackMap core is not installed.
+
+## Future core discovery (documented, not implemented here)
+
+AttackMap core can discover this analyzer later via one of these options:
+
+1. entry points (preferred long-term)
+2. explicit configured analyzer list
+3. namespace/package scanning in `github.com/mlaify`
+
+This repository does not implement core-side discovery logic.
+
+## Limitations
+
+- regex-based extraction (not AST)
+- limited config route parsing
+- no framework-specific deep parsing yet
+- no dataflow or reachability modeling inside this analyzer
+
+These are deliberate to keep this first external analyzer incremental and maintainable.

attackmap_analyzer_php_web-0.1.0/README.md

@@ -0,0 +1,93 @@
+# attackmap-analyzer-php-web
+
+Broad PHP web analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This repository is intentionally separate from AttackMap core. It focuses only on extracting structured signals from PHP repositories:
+
+- routes
+- outbound HTTP calls
+- datastore hints
+- auth hints
+- secret and env usage
+
+It does not render reports and does not own global severity policy.
+
+## Analyzer identity
+
+- `name`: `php-web`
+- `display_name`: `PHP Web Analyzer`
+- `version`: `0.1.0`
+- `experimental`: `true`
+- `enabled_by_default`: `false`
+
+## Scope
+
+This analyzer is broad and heuristic. It is meant to map common PHP web application surfaces before framework-specific analyzers (for example `php-laminas` or `omeka-s`) are added.
+
+## Detection strategy
+
+`detect(repo_path)` uses lightweight signals:
+
+- `composer.json` present
+- at least one `.php` file
+- common PHP app layout (`src/`, `app/`, `module/`, `public/`)
+
+## Extraction strategy
+
+`analyze(repo_path)` scans `.php` files and emits structured signals using regular-expression heuristics.
+
+Route extraction currently includes patterns such as:
+
+- `Route::get(...)`/`Route::post(...)` style calls
+- `$app->get(...)` style calls
+- PHP attributes like `#[Route("/path", methods: ["GET"]) ]`
+- basic config-style `"path" => "/..."`
+
+Outbound calls currently include patterns such as:
+
+- `curl_init("https://...")`
+- `file_get_contents("https://...")`
+- common HTTP client calls such as `->request(...)`, `->get(...)`, `->post(...)`
+
+Datastore/auth/secret hints are similarly heuristic and intended as first-pass signals.
+
+## Installation
+
+```bash
+pip install attackmap-analyzer-php-web
+```
+
+For local development:
+
+```bash
+pip install -e .[dev]
+```
+
+## Contract alignment with AttackMap core
+
+This package targets the current AttackMap analyzer contract:
+
+- analyzer exposes metadata via `metadata`
+- analyzer implements `detect(repo_path)` and `analyze(repo_path)`
+- `analyze` returns AttackMap-style structured scan data (`ScanResult` shape)
+
+The package includes a small compatibility layer so tests can run even if AttackMap core is not installed.
+
+## Future core discovery (documented, not implemented here)
+
+AttackMap core can discover this analyzer later via one of these options:
+
+1. entry points (preferred long-term)
+2. explicit configured analyzer list
+3. namespace/package scanning in `github.com/mlaify`
+
+This repository does not implement core-side discovery logic.
+
+## Limitations
+
+- regex-based extraction (not AST)
+- limited config route parsing
+- no framework-specific deep parsing yet
+- no dataflow or reachability modeling inside this analyzer
+
+These are deliberate to keep this first external analyzer incremental and maintainable.

attackmap_analyzer_php_web-0.1.0/pyproject.toml

@@ -0,0 +1,74 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "attackmap-analyzer-php-web"
+version = "0.1.0"
+description = "Broad PHP web analyzer plugin for AttackMap"
+readme = "README.md"
+requires-python = ">=3.11"
+license = {text = "MIT"}
+authors = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+  {name = "AttackMap Contributors"},
+]
+maintainers = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+]
+keywords = [
+  "security",
+  "static-analysis",
+  "appsec",
+  "defensive-security",
+  "attackmap",
+  "attackmap-plugin",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "Intended Audience :: Information Technology",
+  "Intended Audience :: System Administrators",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security",
+  "Topic :: Software Development :: Quality Assurance",
+  "Typing :: Typed",
+]
+dependencies = [
+  "pydantic>=2.7.0",
+]
+
+[project.optional-dependencies]
+core = [
+  "attackmap>=0.1.0",
+]
+dev = [
+  "pytest>=8.0.0",
+  "build>=1.2.0",
+  "attackmap>=0.1.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/mlaify/attackmap-analyzer-php-web"
+Repository = "https://github.com/mlaify/attackmap-analyzer-php-web"
+Issues = "https://github.com/mlaify/attackmap-analyzer-php-web/issues"
+Changelog = "https://github.com/mlaify/attackmap-analyzer-php-web/blob/main/CHANGELOG.md"
+"AttackMap core" = "https://github.com/mlaify/AttackMap"
+
+[project.entry-points."attackmap.analyzers"]
+php_web = "attackmap_analyzer_php_web:PhpWebAnalyzer"
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

attackmap_analyzer_php_web-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

attackmap_analyzer_php_web-0.1.0/src/attackmap_analyzer_php_web/__init__.py

@@ -0,0 +1,4 @@
+from .analyzer import PhpWebAnalyzer
+from .contracts import AnalyzerMetadata
+
+__all__ = ["AnalyzerMetadata", "PhpWebAnalyzer"]

attackmap_analyzer_php_web-0.1.0/src/attackmap_analyzer_php_web/analyzer.py

@@ -0,0 +1,230 @@
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+from .contracts import AnalyzerMetadata, AuthHint, DatabaseHint, ExternalCall, Route, ScanResult, SecretHint
+
+HTTP_METHODS = ("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD")
+
+LARAVEL_ROUTE_PATTERN = re.compile(
+    r"\bRoute::(get|post|put|patch|delete|options|head|any|match)\s*\(\s*['\"]([^'\"]+)['\"]",
+    re.IGNORECASE,
+)
+SLIM_ROUTE_PATTERN = re.compile(
+    r"\$\w+->(get|post|put|patch|delete|options|head|any|map)\s*\(\s*['\"]([^'\"]+)['\"]",
+    re.IGNORECASE,
+)
+ATTRIBUTE_ROUTE_PATTERN = re.compile(
+    r"#\[\s*Route\s*\(\s*['\"]([^'\"]+)['\"](?P<args>.*?)\)\s*\]",
+    re.IGNORECASE | re.DOTALL,
+)
+ATTRIBUTE_METHOD_PATTERN = re.compile(r"['\"](GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD)['\"]", re.IGNORECASE)
+CONFIG_ROUTE_PATH_PATTERN = re.compile(r"['\"]path['\"]\s*=>\s*['\"]([^'\"]+)['\"]", re.IGNORECASE)
+
+OUTBOUND_PATTERNS = [
+    re.compile(r"curl_init\s*\(\s*['\"](https?://[^'\"]+)['\"]", re.IGNORECASE),
+    re.compile(r"file_get_contents\s*\(\s*['\"](https?://[^'\"]+)['\"]", re.IGNORECASE),
+    re.compile(r"->request\s*\(\s*['\"](?:GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD)['\"]\s*,\s*['\"](https?://[^'\"]+)['\"]", re.IGNORECASE),
+    re.compile(r"->(?:get|post|put|patch|delete)\s*\(\s*['\"](https?://[^'\"]+)['\"]", re.IGNORECASE),
+]
+
+DATABASE_PATTERNS = [
+    (re.compile(r"\bnew\s+PDO\s*\(", re.IGNORECASE), "sql"),
+    (re.compile(r"\bmysqli_connect\s*\(", re.IGNORECASE), "mysql"),
+    (re.compile(r"\bnew\s+mysqli\s*\(", re.IGNORECASE), "mysql"),
+    (re.compile(r"Doctrine\\DBAL|Doctrine\\ORM|EntityManager", re.IGNORECASE), "sql"),
+    (re.compile(r"\bpg_connect\s*\(", re.IGNORECASE), "postgresql"),
+    (re.compile(r"\bRedis\s*::|\bnew\s+Redis\s*\(", re.IGNORECASE), "redis"),
+]
+
+AUTH_PATTERNS = [
+    (re.compile(r"\bsession_start\s*\(", re.IGNORECASE), "session"),
+    (re.compile(r"\$_SESSION\b", re.IGNORECASE), "session"),
+    (re.compile(r"\bpassword_hash\s*\(", re.IGNORECASE), "password_hash"),
+    (re.compile(r"\bpassword_verify\s*\(", re.IGNORECASE), "password_verify"),
+    (re.compile(r"JWT|firebase\\jwt", re.IGNORECASE), "jwt"),
+    (re.compile(r"\bmiddleware\s*\(\s*['\"]auth['\"]", re.IGNORECASE), "auth_middleware"),
+    (re.compile(r"\bAuth::|\bauth\s*\(", re.IGNORECASE), "auth"),
+]
+
+SECRET_PATTERNS = [
+    re.compile(r"getenv\s*\(\s*['\"]([A-Z0-9_]*(SECRET|TOKEN|KEY|PASSWORD|API|DB)[A-Z0-9_]*)['\"]", re.IGNORECASE),
+    re.compile(r"\$_ENV\s*\[\s*['\"]([A-Z0-9_]*(SECRET|TOKEN|KEY|PASSWORD|API|DB)[A-Z0-9_]*)['\"]\s*\]", re.IGNORECASE),
+    re.compile(r"\$_SERVER\s*\[\s*['\"]([A-Z0-9_]*(SECRET|TOKEN|KEY|PASSWORD|API|DB)[A-Z0-9_]*)['\"]\s*\]", re.IGNORECASE),
+]
+
+
+class PhpWebAnalyzer:
+    metadata = AnalyzerMetadata(
+        name="php-web",
+        display_name="PHP Web Analyzer",
+        version="0.1.0",
+        description="Broad PHP web analyzer that emits structured security-relevant scan signals.",
+        scope="Generic PHP web projects using route declarations, web controllers, and common HTTP/database/auth patterns.",
+        targets=["php-web"],
+        languages=["php"],
+        priority=40,
+        experimental=True,
+        enabled_by_default=False,
+    )
+
+    @property
+    def name(self) -> str:
+        return self.metadata.name
+
+    def detect(self, repo_path: str | Path) -> bool:
+        root = Path(repo_path).resolve()
+        if not root.exists() or not root.is_dir():
+            return False
+
+        if (root / "composer.json").exists():
+            return True
+
+        if any((root / directory).is_dir() for directory in ("src", "app", "module", "public", "config")):
+            return True
+
+        return any(root.rglob("*.php"))
+
+    def analyze(self, repo_path: str | Path) -> ScanResult:
+        root = Path(repo_path).resolve()
+        result = ScanResult(root=str(root))
+
+        if not root.exists() or not root.is_dir():
+            return result
+
+        composer_path = root / "composer.json"
+        if composer_path.exists():
+            self._extract_composer_signals(composer_path, result)
+
+        for file_path in root.rglob("*.php"):
+            if not file_path.is_file():
+                continue
+            if any(part in {"vendor", ".git", "node_modules"} for part in file_path.parts):
+                continue
+
+            result.files_scanned += 1
+            if "php" not in result.languages:
+                result.languages.append("php")
+
+            content = self._read_text(file_path)
+            if content is None:
+                continue
+
+            relative = str(file_path.relative_to(root))
+            self._extract_routes(content, relative, result)
+            self._extract_external_calls(content, relative, result)
+            self._extract_datastores(content, relative, result)
+            self._extract_auth_hints(content, relative, result)
+            self._extract_secret_hints(content, relative, result)
+
+        result.languages.sort()
+        return result
+
+    def _extract_composer_signals(self, composer_path: Path, result: ScanResult) -> None:
+        try:
+            data = json.loads(composer_path.read_text(encoding="utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            return
+
+        requirements = {
+            **(data.get("require", {}) if isinstance(data.get("require", {}), dict) else {}),
+            **(data.get("require-dev", {}) if isinstance(data.get("require-dev", {}), dict) else {}),
+        }
+
+        for package in requirements:
+            lower = package.lower()
+            if "doctrine" in lower:
+                self._append_unique_database(result, "sql", "composer.json")
+            if "guzzle" in lower or "symfony/http-client" in lower:
+                self._append_unique_auth(result, "http_client", "composer.json")
+            if "firebase/php-jwt" in lower:
+                self._append_unique_auth(result, "jwt", "composer.json")
+
+    def _extract_routes(self, content: str, relative: str, result: ScanResult) -> None:
+        for match in LARAVEL_ROUTE_PATTERN.finditer(content):
+            method, path = match.group(1).upper(), match.group(2)
+            if method == "ANY" or method == "MATCH":
+                method = "ANY"
+            self._append_unique_route(result, path, method, relative)
+
+        for match in SLIM_ROUTE_PATTERN.finditer(content):
+            method, path = match.group(1).upper(), match.group(2)
+            if method == "MAP" or method == "ANY":
+                method = "ANY"
+            self._append_unique_route(result, path, method, relative)
+
+        for match in ATTRIBUTE_ROUTE_PATTERN.finditer(content):
+            path = match.group(1)
+            args = match.group("args")
+            methods = [m.upper() for m in ATTRIBUTE_METHOD_PATTERN.findall(args)]
+            if not methods:
+                methods = ["ANY"]
+            for method in methods:
+                self._append_unique_route(result, path, method, relative)
+
+        for match in CONFIG_ROUTE_PATH_PATTERN.finditer(content):
+            self._append_unique_route(result, match.group(1), "ANY", relative)
+
+    def _extract_external_calls(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in OUTBOUND_PATTERNS:
+            for match in pattern.finditer(content):
+                self._append_unique_external(result, match.group(1), relative)
+
+    def _extract_datastores(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, kind in DATABASE_PATTERNS:
+            if pattern.search(content):
+                self._append_unique_database(result, kind, relative)
+
+    def _extract_auth_hints(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, hint in AUTH_PATTERNS:
+            if pattern.search(content):
+                self._append_unique_auth(result, hint, relative)
+
+    def _extract_secret_hints(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in SECRET_PATTERNS:
+            for match in pattern.finditer(content):
+                self._append_unique_secret(result, match.group(1), relative)
+
+    @staticmethod
+    def _read_text(path: Path) -> str | None:
+        try:
+            return path.read_text(encoding="utf-8")
+        except UnicodeDecodeError:
+            return None
+
+    @staticmethod
+    def _append_unique_route(result: ScanResult, path: str, method: str, file: str) -> None:
+        key = (path, method, file)
+        if any((item.path, item.method, item.file) == key for item in result.routes):
+            return
+        result.routes.append(Route(path=path, method=method, file=file))
+
+    @staticmethod
+    def _append_unique_external(result: ScanResult, target: str, file: str) -> None:
+        key = (target, file)
+        if any((item.target, item.file) == key for item in result.external_calls):
+            return
+        result.external_calls.append(ExternalCall(target=target, file=file))
+
+    @staticmethod
+    def _append_unique_database(result: ScanResult, kind: str, file: str) -> None:
+        key = (kind, file)
+        if any((item.kind, item.file) == key for item in result.databases):
+            return
+        result.databases.append(DatabaseHint(kind=kind, file=file))
+
+    @staticmethod
+    def _append_unique_auth(result: ScanResult, hint: str, file: str) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.auth_hints):
+            return
+        result.auth_hints.append(AuthHint(hint=hint, file=file))
+
+    @staticmethod
+    def _append_unique_secret(result: ScanResult, name: str, file: str) -> None:
+        key = (name, file)
+        if any((item.name, item.file) == key for item in result.secret_hints):
+            return
+        result.secret_hints.append(SecretHint(name=name, file=file))

attackmap_analyzer_php_web-0.1.0/src/attackmap_analyzer_php_web/contracts.py

@@ -0,0 +1,18 @@
+from __future__ import annotations
+
+from attackmap.sdk.contracts import AnalyzerMetadata, AnalyzerProtocol
+from attackmap.sdk.models import AuthHint, DatabaseHint, ExternalCall, Route, ScanResult, SecretHint
+
+# Compatibility alias used by existing analyzer implementations.
+AttackMapAnalyzerProtocol = AnalyzerProtocol
+
+__all__ = [
+    "AnalyzerMetadata",
+    "AttackMapAnalyzerProtocol",
+    "Route",
+    "ExternalCall",
+    "DatabaseHint",
+    "AuthHint",
+    "SecretHint",
+    "ScanResult",
+]

attackmap_analyzer_php_web-0.1.0/src/attackmap_analyzer_php_web.egg-info/PKG-INFO

@@ -0,0 +1,133 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-php-web
+Version: 0.1.0
+Summary: Broad PHP web analyzer plugin for AttackMap
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-php-web
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-php-web
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-php-web/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-php-web/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-php-web
+
+Broad PHP web analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This repository is intentionally separate from AttackMap core. It focuses only on extracting structured signals from PHP repositories:
+
+- routes
+- outbound HTTP calls
+- datastore hints
+- auth hints
+- secret and env usage
+
+It does not render reports and does not own global severity policy.
+
+## Analyzer identity
+
+- `name`: `php-web`
+- `display_name`: `PHP Web Analyzer`
+- `version`: `0.1.0`
+- `experimental`: `true`
+- `enabled_by_default`: `false`
+
+## Scope
+
+This analyzer is broad and heuristic. It is meant to map common PHP web application surfaces before framework-specific analyzers (for example `php-laminas` or `omeka-s`) are added.
+
+## Detection strategy
+
+`detect(repo_path)` uses lightweight signals:
+
+- `composer.json` present
+- at least one `.php` file
+- common PHP app layout (`src/`, `app/`, `module/`, `public/`)
+
+## Extraction strategy
+
+`analyze(repo_path)` scans `.php` files and emits structured signals using regular-expression heuristics.
+
+Route extraction currently includes patterns such as:
+
+- `Route::get(...)`/`Route::post(...)` style calls
+- `$app->get(...)` style calls
+- PHP attributes like `#[Route("/path", methods: ["GET"]) ]`
+- basic config-style `"path" => "/..."`
+
+Outbound calls currently include patterns such as:
+
+- `curl_init("https://...")`
+- `file_get_contents("https://...")`
+- common HTTP client calls such as `->request(...)`, `->get(...)`, `->post(...)`
+
+Datastore/auth/secret hints are similarly heuristic and intended as first-pass signals.
+
+## Installation
+
+```bash
+pip install attackmap-analyzer-php-web
+```
+
+For local development:
+
+```bash
+pip install -e .[dev]
+```
+
+## Contract alignment with AttackMap core
+
+This package targets the current AttackMap analyzer contract:
+
+- analyzer exposes metadata via `metadata`
+- analyzer implements `detect(repo_path)` and `analyze(repo_path)`
+- `analyze` returns AttackMap-style structured scan data (`ScanResult` shape)
+
+The package includes a small compatibility layer so tests can run even if AttackMap core is not installed.
+
+## Future core discovery (documented, not implemented here)
+
+AttackMap core can discover this analyzer later via one of these options:
+
+1. entry points (preferred long-term)
+2. explicit configured analyzer list
+3. namespace/package scanning in `github.com/mlaify`
+
+This repository does not implement core-side discovery logic.
+
+## Limitations
+
+- regex-based extraction (not AST)
+- limited config route parsing
+- no framework-specific deep parsing yet
+- no dataflow or reachability modeling inside this analyzer
+
+These are deliberate to keep this first external analyzer incremental and maintainable.

attackmap_analyzer_php_web-0.1.0/src/attackmap_analyzer_php_web.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/attackmap_analyzer_php_web/__init__.py
+src/attackmap_analyzer_php_web/analyzer.py
+src/attackmap_analyzer_php_web/contracts.py
+src/attackmap_analyzer_php_web.egg-info/PKG-INFO
+src/attackmap_analyzer_php_web.egg-info/SOURCES.txt
+src/attackmap_analyzer_php_web.egg-info/dependency_links.txt
+src/attackmap_analyzer_php_web.egg-info/entry_points.txt
+src/attackmap_analyzer_php_web.egg-info/requires.txt
+src/attackmap_analyzer_php_web.egg-info/top_level.txt
+tests/test_php_web_analyzer.py

attackmap_analyzer_php_web-0.1.0/src/attackmap_analyzer_php_web.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

attackmap_analyzer_php_web-0.1.0/src/attackmap_analyzer_php_web.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+php_web = attackmap_analyzer_php_web:PhpWebAnalyzer

attackmap_analyzer_php_web-0.1.0/src/attackmap_analyzer_php_web.egg-info/requires.txt

@@ -0,0 +1,9 @@
+pydantic>=2.7.0
+
+[core]
+attackmap>=0.1.0
+
+[dev]
+pytest>=8.0.0
+build>=1.2.0
+attackmap>=0.1.0

attackmap_analyzer_php_web-0.1.0/src/attackmap_analyzer_php_web.egg-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_php_web

attackmap_analyzer_php_web-0.1.0/tests/test_php_web_analyzer.py

@@ -0,0 +1,105 @@
+from pathlib import Path
+
+from attackmap.sdk.contracts import AnalyzerMetadata as SharedAnalyzerMetadata
+from attackmap.sdk.models import ScanResult as SharedScanResult
+from attackmap_analyzer_php_web.contracts import AnalyzerMetadata, ScanResult
+from attackmap_analyzer_php_web import PhpWebAnalyzer
+
+FIXTURES = Path(__file__).parent / "fixtures"
+
+
+def test_contracts_use_shared_sdk_types() -> None:
+    assert AnalyzerMetadata is SharedAnalyzerMetadata
+    assert ScanResult is SharedScanResult
+
+
+def test_metadata_contains_required_fields() -> None:
+    analyzer = PhpWebAnalyzer()
+    metadata = analyzer.metadata
+
+    assert metadata.name == "php-web"
+    assert metadata.display_name == "PHP Web Analyzer"
+    assert metadata.version == "0.1.0"
+    assert metadata.description
+    assert metadata.scope
+    assert metadata.targets
+    assert metadata.languages == ["php"]
+    assert isinstance(metadata.priority, int)
+    assert metadata.experimental is True
+    assert metadata.enabled_by_default is False
+
+
+def test_detect_identifies_php_web_project() -> None:
+    analyzer = PhpWebAnalyzer()
+
+    assert analyzer.detect(FIXTURES / "php_web_app") is True
+
+
+def test_detect_identifies_minimal_php_repository() -> None:
+    analyzer = PhpWebAnalyzer()
+
+    assert analyzer.detect(FIXTURES / "php_minimal_repo") is True
+
+
+def test_detect_identifies_composer_based_php_repository() -> None:
+    analyzer = PhpWebAnalyzer()
+
+    assert analyzer.detect(FIXTURES / "php_composer_repo") is True
+
+
+def test_detect_identifies_php_repository_with_common_directories() -> None:
+    analyzer = PhpWebAnalyzer()
+
+    assert analyzer.detect(FIXTURES / "php_common_dirs_repo") is True
+
+
+def test_detect_identifies_php_library_repository() -> None:
+    analyzer = PhpWebAnalyzer()
+
+    assert analyzer.detect(FIXTURES / "php_non_web_lib") is True
+
+
+def test_analyze_extracts_routes_and_http_calls() -> None:
+    analyzer = PhpWebAnalyzer()
+    result = analyzer.analyze(FIXTURES / "php_web_app")
+
+    route_keys = {(route.path, route.method) for route in result.routes}
+    outbound_targets = {call.target for call in result.external_calls}
+
+    assert ("/health", "GET") in route_keys
+    assert ("/login", "POST") in route_keys
+    assert "https://api.example.com/v1/ping" in outbound_targets
+    assert "https://payments.example.com/check" in outbound_targets
+    assert "https://hooks.example.com/notify" in outbound_targets
+
+
+def test_analyze_extracts_datastore_auth_and_secret_hints() -> None:
+    analyzer = PhpWebAnalyzer()
+    result = analyzer.analyze(FIXTURES / "php_web_app")
+
+    db_hints = {hint.kind for hint in result.databases}
+    auth_hints = {hint.hint for hint in result.auth_hints}
+    secret_names = {hint.name for hint in result.secret_hints}
+
+    assert "sql" in db_hints
+    assert "mysql" in db_hints
+    assert "session" in auth_hints
+    assert "password_hash" in auth_hints
+    assert "password_verify" in auth_hints
+    assert "JWT_SECRET" in secret_names
+    assert "API_KEY" in secret_names
+    assert "ACCESS_TOKEN" in secret_names
+
+
+def test_analyze_returns_core_compatible_scan_shape() -> None:
+    analyzer = PhpWebAnalyzer()
+    result = analyzer.analyze(FIXTURES / "php_web_app")
+
+    assert isinstance(result.root, str)
+    assert isinstance(result.files_scanned, int)
+    assert isinstance(result.languages, list)
+    assert hasattr(result, "routes")
+    assert hasattr(result, "external_calls")
+    assert hasattr(result, "databases")
+    assert hasattr(result, "auth_hints")
+    assert hasattr(result, "secret_hints")