attackmap-analyzer-php-web 0.2.0__py3-none-any.whl

attackmap_analyzer_php_web/symfony_routes.py

@@ -0,0 +1,428 @@
+"""Symfony routes from ``#[Route]`` attributes and YAML/XML route config (#3).
+
+- ``#[Route('/x', methods: [...])]`` (or ``path: '/x'``) on an action; a
+  class-level ``#[Route('/prefix')]`` is joined onto every action's path
+  (and its ``methods`` merged), as Symfony's attribute loader does. A class
+  route is a route of its own only when no action of the class declares one
+  (an invokable controller).
+- ``config/routes.yaml``, ``config/routes/*.yaml`` and ``*.xml`` (and Symfony
+  2/3's ``app/config/routing*.yml``): ``path`` / ``methods`` entries are
+  routes, and ``resource`` imports carry a ``prefix`` onto the routes they
+  load: attribute controllers under a directory (``../src/Controller/``,
+  ``routing.controllers``) or another local route file.
+
+The YAML and XML readers are line/tag scanners, not full parsers: they read
+the shapes Symfony's docs and recipes use and skip anything else (localized
+path maps, ``when@dev`` blocks, bundle ``@`` resources). A prefix that can't
+be read (a localized prefix map) becomes a ``{prefix}`` segment rather than a
+wrong path, and access_control isn't resolved for those routes. Symfony keys
+routes by name, so a later import of the same controllers or route file
+replaces the earlier one: each route is emitted once, under the last prefix.
+"""
+
+from __future__ import annotations
+
+import posixpath
+import re
+from dataclasses import dataclass, field
+
+from attackmap.sdk import line_of
+
+from . import route_auth as ra
+
+HTTP_METHODS = frozenset({"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"})
+
+# Route config Symfony loads on its own, in the kernel's order
+# (MicroKernelTrait::configureRoutes): `config/routes/*.yaml` first, sorted,
+# then `config/routes.yaml` last, so the latter's imports win a route-name
+# collision. The kernel's glob is `*.{php,yaml}`: `.yml` / `.xml` files
+# there are only read when something imports them. Symfony 2/3's
+# `app/config/routing.*` comes from the framework config.
+ROUTE_CONFIG_DIR = "config/routes"
+ROUTE_CONFIG_DIR_SUFFIXES = (".yaml",)
+ROUTE_CONFIG_LAST = ("config/routes.yaml",)
+LEGACY_ROUTE_CONFIG_FILES = ("app/config/routing.yml", "app/config/routing.yaml", "app/config/routing.xml")
+ROUTE_CONFIG_SUFFIXES = (".yaml", ".yml", ".xml")
+# Imports followed this deep; files loaded and entries read at most this many.
+MAX_IMPORT_DEPTH = 4
+MAX_CONFIG_FILES = 64
+# Distinct prefixes (different route-name prefixes) per attribute route.
+MAX_PREFIXES = 8
+MAX_ENTRIES = 2000
+MAX_LINES = 20000
+
+_ROUTE_ATTR = re.compile(r"\\?(?:[\w\\]+\\)?Route\s*\(")
+_POSITIONAL_PATH = re.compile(r"\s*(?:'([^'\\]*)'|\"([^\"\\]*)\")")
+_NAMED_PATH = re.compile(r"\bpath\s*:\s*(?:'([^'\\]*)'|\"([^\"\\]*)\")")
+_NAMED_METHODS = re.compile(r"\bmethods\s*:\s*(\[[^\]]*\]|'[^']*'|\"[^\"]*\")")
+_METHOD_NAME = re.compile(r"[A-Za-z]+")
+
+
+@dataclass
+class RouteAttr:
+    path: str | None  # None: no literal path (localized map, constant, ...)
+    methods: list[str]
+
+
+def route_attribute(item: str) -> RouteAttr | None:
+    """A ``Route(...)`` attribute (one item of a ``#[...]`` group), or None."""
+    match = _ROUTE_ATTR.match(item)
+    if not match:
+        return None
+    args = item[match.end() :]
+    path = None
+    positional = _POSITIONAL_PATH.match(args)
+    if positional:
+        path = positional.group(1) if positional.group(1) is not None else positional.group(2)
+    else:
+        named = _NAMED_PATH.search(args)
+        if named:
+            path = named.group(1) if named.group(1) is not None else named.group(2)
+        elif not args.lstrip().startswith("["):
+            # `#[Route(name: 'x_')]`: no path; a class prefix of ''.
+            path = "" if "path" not in args else None
+    methods = []
+    named_methods = _NAMED_METHODS.search(args)
+    if named_methods:
+        methods = _methods(named_methods.group(1))
+    return RouteAttr(path, methods)
+
+
+def _methods(text: str) -> list[str]:
+    found = [m.upper() for m in _METHOD_NAME.findall(text)]
+    return list(dict.fromkeys(m for m in found if m in HTTP_METHODS))
+
+
+def class_path(prefix: str, path: str) -> str:
+    """Symfony's attribute loader concatenates the class and action paths."""
+    return prefix + path
+
+
+def import_prefix(prefix: str, path: str) -> str:
+    """``RouteCollection::addPrefix``: ``'/' . trim($prefix, '/') . $path``."""
+    prefix = prefix.strip().strip("/")
+    if not prefix:
+        return path
+    return "/" + prefix + path
+
+
+# ---------- route config ----------
+
+
+@dataclass
+class ConfigRoute:
+    method: str
+    path: str
+    file: str
+    line: int
+
+
+@dataclass
+class RouteConfig:
+    """Routes from config files, and the import prefixes of attribute
+    controllers.
+
+    Symfony keys routes by name: an import that re-adds a route name
+    replaces the earlier route. So an import of the same controllers or the
+    same route file with the same effective ``name_prefix`` replaces the
+    earlier one (the last in load order wins), while imports with different
+    name prefixes both stay live.
+    """
+
+    # (config file, entry line, name prefix) -> routes.
+    route_sets: dict[tuple[str, int, str], list[ConfigRoute]] = field(default_factory=dict)
+    # target (dir ending in "/", or file) -> name prefix -> (load order, path prefix).
+    imports_by_target: dict[str, dict[str, tuple[int, str]]] = field(default_factory=dict)
+    _order: int = 0
+
+    @property
+    def routes(self) -> list[ConfigRoute]:
+        return [route for routes in self.route_sets.values() for route in routes]
+
+    def add_import(self, target: str, prefix: str, name_prefix: str = "") -> None:
+        """Record an import. Each target keeps the MAX_PREFIXES most recent
+        name prefixes (dict order is recency), so a lookup stays bounded."""
+        self._order += 1
+        entries = self.imports_by_target.setdefault(target, {})
+        entries.pop(name_prefix, None)
+        entries[name_prefix] = (self._order, prefix)
+        if len(entries) > MAX_PREFIXES:
+            del entries[next(iter(entries))]
+
+    def prefixes_for(self, file: str) -> list[str]:
+        """Import prefixes for attribute routes in ``file``: for each name
+        prefix, the last import (in load order) covering the file. A prefix
+        that couldn't be read is a ``{prefix}`` segment. Looks up the file
+        and each ancestor directory, so it's O(path depth)."""
+        if not self.imports_by_target:
+            return [""]
+        parts = file.split("/")
+        candidates = ["./", file] + ["/".join(parts[:i]) + "/" for i in range(1, len(parts))]
+        latest: dict[str, tuple[int, str]] = {}
+        for target in candidates:
+            for name_prefix, (order, prefix) in self.imports_by_target.get(target, {}).items():
+                if name_prefix not in latest or order > latest[name_prefix][0]:
+                    latest[name_prefix] = (order, prefix)
+        if not latest:
+            return [""]
+        ordered = sorted(latest.values())
+        # The most recent imports, oldest first.
+        return list(dict.fromkeys(prefix for _, prefix in ordered))[-MAX_PREFIXES:]
+
+
+@dataclass
+class _Entry:
+    name: str
+    line: int
+    values: dict[str, str]
+    nested: set[str]  # keys whose value is a nested mapping/list
+
+
+_FLOW_PAIR = re.compile(r"([\w.@-]+)\s*:\s*('[^']*'|\"[^\"]*\"|\[[^\]]*\]|\{|[^,{}\[\]]+)")
+_FLOW_PATH = re.compile(r"\bpath\s*:\s*([^,}]+)")
+_YAML_KEY = re.compile(r"([\w.@-]+|'[^']*'|\"[^\"]*\")\s*:(?:\s+(.*))?$")
+
+
+def _unquote(value: str) -> str:
+    value = value.strip()
+    if " #" in value:
+        value = value.split(" #", 1)[0].rstrip()
+    if len(value) >= 2 and value[0] == value[-1] and value[0] in "'\"":
+        return value[1:-1]
+    return value
+
+
+def _flow_entry(entry: _Entry, text: str) -> None:
+    """Top-level keys of a one-line flow mapping. A key whose value is a
+    nested mapping (``prefix: {en: '', nl: /nl}``) is recorded as nested,
+    and that mapping's own keys are skipped."""
+    body = text[1:]
+    pos = 0
+    depth = 0
+    parent = None
+    for pair in _FLOW_PAIR.finditer(body):
+        between = body[pos : pair.start()]
+        depth += between.count("{") - between.count("}")
+        pos = pair.end()
+        name, value = pair.group(1), pair.group(2)
+        if depth == 1 and parent is not None and value != "{":
+            # `resource: {path: ../src/Controller/, namespace: ...}`.
+            entry.values.setdefault(f"{parent}.{name}", value.strip())
+            continue
+        if depth > 0:
+            continue
+        if value == "{":
+            entry.nested.add(name)
+            parent = name
+            depth += 1
+        elif name not in entry.values and name not in entry.nested:
+            entry.values[name] = value.strip()
+
+
+def parse_yaml_entries(text: str) -> list[_Entry]:
+    """Top-level route entries (``name:`` + indented keys) of a routes YAML.
+
+    ``when@prod:`` blocks are read as top-level; other ``when@<env>`` blocks
+    are skipped (dev/test only). A key whose value is a nested mapping is
+    recorded as ``key.subkey``."""
+    entries: list[_Entry] = []
+    entry: _Entry | None = None
+    child_indent: int | None = None
+    parent_key: str | None = None
+    base: int | None = 0  # indent of route names; None: set by the next line
+    skipping = False
+    for number, raw in enumerate(text.splitlines()[:MAX_LINES], start=1):
+        stripped = raw.strip()
+        if not stripped or stripped.startswith("#") or stripped == "---":
+            continue
+        indent = len(raw) - len(raw.lstrip(" "))
+        key = _YAML_KEY.match(stripped)
+        if indent == 0:
+            entry = None
+            skipping = False
+            base = 0
+            if key and key.group(1).startswith("when@"):
+                if key.group(1) == "when@prod":
+                    base = None
+                else:
+                    skipping = True
+                continue
+        elif skipping:
+            continue
+        if base is None:
+            base = indent
+        if indent == base:
+            entry = None
+            if key and len(entries) < MAX_ENTRIES:
+                entry = _Entry(_unquote(key.group(1)), number, {}, set())
+                entries.append(entry)
+                child_indent = None
+                parent_key = None
+                inline = (key.group(2) or "").strip()
+                if inline.startswith("{"):
+                    # `name: { path: /x, methods: [GET] }` on one line.
+                    _flow_entry(entry, inline)
+                    entry = None
+            continue
+        if entry is None or not key or indent < base:
+            continue
+        name = _unquote(key.group(1))
+        value = key.group(2)
+        if child_indent is None:
+            child_indent = indent
+        if indent == child_indent:
+            parent_key = name
+            if value is None or not value.strip() or value.strip().startswith("#"):
+                entry.nested.add(name)
+            else:
+                entry.values[name] = value.strip()
+        elif indent > child_indent and parent_key is not None and value is not None:
+            entry.values[f"{parent_key}.{name}"] = value.strip()
+    return entries
+
+
+_XML_COMMENT_OPEN = "<!--"
+_XML_TAG = re.compile(r"<(route|import)\b([^<>]{0,4000})>")
+_XML_ATTR = re.compile(r"([\w:-]+)\s*=\s*(?:\"([^\"]*)\"|'([^']*)')")
+
+
+def _strip_xml_comments(text: str) -> str:
+    """Blank out ``<!-- ... -->`` (keeping offsets), one forward scan."""
+    out = []
+    pos = 0
+    while True:
+        start = text.find(_XML_COMMENT_OPEN, pos)
+        if start < 0:
+            out.append(text[pos:])
+            break
+        end = text.find("-->", start + 4)
+        stop = len(text) if end < 0 else end + 3
+        out.append(text[pos:start])
+        out.append("".join(ch if ch == "\n" else " " for ch in text[start:stop]))
+        pos = stop
+        if end < 0:
+            break
+    return "".join(out)
+
+
+def parse_xml_entries(text: str) -> list[_Entry]:
+    text = _strip_xml_comments(text)
+    entries = []
+    for match in _XML_TAG.finditer(text):
+        attrs = {m.group(1): m.group(2) if m.group(2) is not None else m.group(3) for m in _XML_ATTR.finditer(match.group(2))}
+        if match.group(1) == "route":
+            values = {k: v for k, v in attrs.items() if k in ("path", "methods", "controller")}
+            nested = set() if "path" in attrs else {"path"}  # <path locale="..."> children
+        else:
+            values = {k: v for k, v in attrs.items() if k in ("resource", "prefix", "type", "name-prefix")}
+            nested = set()
+        entries.append(_Entry(attrs.get("id", ""), line_of(text, match.start()), values, nested))
+        if len(entries) >= MAX_ENTRIES:
+            break
+    return entries
+
+
+def _resolve(base_dir: str, resource: str) -> str | None:
+    """A repo-relative path for ``resource`` (relative to the config file's
+    directory), or None for bundle (``@``), absolute or out-of-repo paths."""
+    resource = resource.strip()
+    if not resource or resource.startswith(("@", "/", "%")) or "://" in resource:
+        return None
+    trailing = resource.endswith("/")
+    target = posixpath.normpath(posixpath.join(base_dir, resource))
+    if target == ".." or target.startswith("../"):
+        return None
+    if target == ".":
+        return "./"
+    return target + "/" if trailing or not posixpath.splitext(target)[1] else target
+
+
+def load_route_config(read, list_dir) -> RouteConfig:
+    """Read the repo's Symfony route config.
+
+    ``read(relative) -> str | None`` reads a repo file (contained, None when
+    missing); ``list_dir(relative) -> list[str]`` lists a directory's files
+    (repo-relative). Kept I/O-free so it can be fuzzed directly."""
+    config = RouteConfig()
+    roots = sorted(f for f in list_dir(ROUTE_CONFIG_DIR) if f.endswith(ROUTE_CONFIG_DIR_SUFFIXES))
+    roots += [*ROUTE_CONFIG_LAST, *LEGACY_ROUTE_CONFIG_FILES]
+    parsed: dict[str, list[_Entry] | None] = {}
+    loads = 0
+
+    def entries_of(relative: str) -> list[_Entry] | None:
+        if relative not in parsed:
+            text = read(relative)
+            if text is None:
+                parsed[relative] = None
+            else:
+                parsed[relative] = parse_xml_entries(text) if relative.endswith(".xml") else parse_yaml_entries(text)
+        return parsed[relative]
+
+    def load(relative: str, prefix: str, name_prefix: str, depth: int) -> None:
+        # Loaded again on a re-import (a later import wins), up to the cap.
+        nonlocal loads
+        if loads >= MAX_CONFIG_FILES or depth > MAX_IMPORT_DEPTH:
+            return
+        loads += 1
+        entries = entries_of(relative)
+        if entries is None:
+            return
+        base_dir = posixpath.dirname(relative)
+        for entry in entries:
+            values = entry.values
+            if "resource" in values or "resource" in entry.nested:
+                _import(entry, base_dir, prefix, name_prefix, depth)
+                continue
+            if "path" in entry.nested or "path" not in values:
+                continue  # localized path map, or not a route
+            path = _unquote(values["path"])
+            if not path.startswith("/"):
+                path = "/" + path
+            methods = _methods(_unquote(values.get("methods", ""))) or ["ANY"]
+            full = import_prefix(prefix, path)
+            key = (relative, entry.line, name_prefix)
+            config.route_sets.pop(key, None)
+            config.route_sets[key] = [ConfigRoute(method, full, relative, entry.line) for method in methods]
+
+    def _import(entry: _Entry, base_dir: str, prefix: str, name_prefix: str, depth: int) -> None:
+        values = entry.values
+        resource = values.get("resource") or values.get("resource.path")
+        if resource is None:
+            return
+        resource = _unquote(resource)
+        if resource.startswith("{"):
+            # Flow mapping: `resource: { path: ../src/Controller/, namespace: App\Controller }`.
+            inner = _FLOW_PATH.search(resource)
+            if inner is None:
+                return
+            resource = _unquote(inner.group(1))
+        if "prefix" in entry.nested or _unquote(values.get("prefix", "")).startswith("{"):
+            # A localized prefix map (`prefix: {en: '', nl: /nl}`): the
+            # real path is one of several, so mark the segment unknown.
+            own = "/" + ra.DYNAMIC_SEGMENT
+        else:
+            own = _unquote(values.get("prefix", ""))
+        combined = _join_prefix(prefix, own)
+        names = name_prefix + _unquote(values.get("name_prefix", values.get("name-prefix", "")))
+        kind = _unquote(values.get("type", ""))
+        if resource == "routing.controllers":
+            # Symfony 7.1+: every attribute-routed controller (src/).
+            config.add_import("src/", combined, names)
+            return
+        target = _resolve(base_dir, resource)
+        if target is None:
+            return
+        if target.endswith(ROUTE_CONFIG_SUFFIXES) and kind not in ("attribute", "annotation"):
+            load(target, combined, names, depth + 1)
+        elif kind in ("attribute", "annotation") or target.endswith("/") or target.endswith(".php"):
+            config.add_import(target, combined, names)
+
+    for relative in roots:
+        load(relative, "", "", 0)
+    return config
+
+
+def _join_prefix(outer: str, inner: str) -> str:
+    inner = inner.strip().strip("/")
+    outer = outer.strip().rstrip("/")
+    return f"{outer}/{inner}" if inner else outer

attackmap_analyzer_php_web-0.2.0.dist-info/METADATA

@@ -0,0 +1,160 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-php-web
+Version: 0.2.0
+Summary: Broad PHP web analyzer plugin for AttackMap
+Author: AttackMap Contributors
+Author-email: Matthew Davis <mlaify@mlaify.io>
+Maintainer-email: Matthew Davis <mlaify@mlaify.io>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-php-web
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-php-web
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-php-web/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-php-web/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.6.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.6.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-php-web
+
+> [!IMPORTANT]
+> **Active development, slow pace.** AttackMap is under active development, but
+> progress may be slow until more contributors or co-maintainers join. Help is
+> very welcome with the core engine, an analyzer, the macOS app, or the docs —
+> see [CONTRIBUTING.md](CONTRIBUTING.md) or open an issue on
+> [mlaify/AttackMap](https://github.com/mlaify/AttackMap/issues) to say hello.
+> Security reports are still welcome at [security@mlaify.io](mailto:security@mlaify.io).
+
+Broad PHP web analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This repository is intentionally separate from AttackMap core. It focuses only on extracting structured signals from PHP repositories:
+
+- routes
+- outbound HTTP calls
+- datastore hints
+- auth hints
+- secret and env usage
+
+It does not render reports and does not own global severity policy.
+
+## Analyzer identity
+
+- `name`: `php-web`
+- `display_name`: `PHP Web Analyzer`
+- `version`: `0.1.0`
+- `experimental`: `true`
+- `enabled_by_default`: `false`
+
+## Scope
+
+This analyzer is broad and heuristic. It is meant to map common PHP web application surfaces before framework-specific analyzers (for example `php-laminas` or `omeka-s`) are added.
+
+## Detection strategy
+
+`detect(repo_path)` uses lightweight signals:
+
+- `composer.json` present, or
+- at least one `.php` file outside `vendor/` (and the other shared skip dirs)
+
+A `src/`, `app/` or `config/` directory on its own is not enough, since Python, Go and Java repos have those too.
+
+## Extraction strategy
+
+`analyze(repo_path)` scans `.php` files and emits structured signals using regular-expression heuristics.
+
+Route extraction currently includes patterns such as:
+
+- Laravel `Route::get|post|put|patch|delete|options|head|any(...)`, array-first `Route::match(['get', 'post'], ...)`, and a scope chained before the verb (`Route::middleware('auth')->get(...)`). `Route::resource` / `apiResource` / `resources` / `apiResources` expand to their REST routes (7 / 5 actions; `update` is `PUT` and `PATCH`), honouring `->only()` / `->except()` / `->shallow()`, an `['only' => ...]` options array and nested `photos.comments` names.
+- Laravel groups: `Route::prefix('admin')->middleware(...)->group(function () { ... })` and `Route::group(['prefix' => ..., 'middleware' => ...], fn)` join their prefixes onto the routes inside, at any nesting depth up to 32. `Route::controller(C::class)->group(...)` dispatches bare method names to `C`.
+- Laravel route files take the prefix and middleware of the group that loads them: `->group(base_path('routes/admin.php'))`, `require base_path(...)` / `$this->loadRoutesFrom(__DIR__.'/...')` inside a group, and `withRouting(api: ... | [...], apiPrefix: ...)` in `bootstrap/app.php`. `routes/api.php` defaults to `/api` when nothing outside test code mounts it. A `require_once` that loops back to a file already being loaded is a no-op. A `config('file.key')` prefix is read from `config/file.php` (a literal or an `env()` default), and any other non-literal prefix becomes a `{prefix}` segment.
+- `$app->get('/path', ...)` / `$app->map(['GET', 'POST'], '/path', ...)` Slim calls. The path must start with `/`, and the receiver must be `$app`, `$router`, `$route`, `$group` or `$r`, a variable assigned from `AppFactory::create()` / `new RouteCollector` / `new App`, or a parameter typed `RouteCollectorProxy` / `RouteCollector` / `App`. This keeps `$request->get('id')` and `$cache->get('k')` out. Slim `$app->group('/v1', ...)` and Lumen `$router->group(['prefix' => 'api'], ...)` prefixes are joined.
+- Symfony `#[Route('/path', methods: ['GET'])]` (or `path:`) attributes, joined onto the class-level `#[Route('/prefix')]` (whose `methods` merge in). A class-level route is a route of its own only on a controller with no routed actions (`__invoke`).
+- Symfony route config, loaded in the kernel's order (`config/routes/*.yaml` sorted, then `config/routes.yaml`; plus Symfony 2/3's `app/config/routing.yml`; other files only when imported): `path` / `methods` entries, and `resource` imports with a `prefix`, applied to attribute controllers under the imported directory (or `routing.controllers`, i.e. `src/`) or to an imported local route file. A later import of the same controllers or route file with the same `name_prefix` replaces the earlier one (Symfony keys routes by name), so each route is reported once per distinct name prefix, under the last import's prefix. A localized prefix map becomes a `{prefix}` segment. Localized path maps and `when@dev` / `when@test` blocks are skipped.
+- config-style `"path" => "/..."`, only in files that also declare a `'routes'` / `'router'` key (so Laravel's `config/logging.php` paths aren't routes)
+
+Brackets are matched in one string-, comment- and heredoc-aware pass per file, so a commented-out `Route::get(...)` is not a route and a `}` inside a string doesn't end a group.
+
+Each route carries `auth`, `guards` and `guard_evidence` (AttackMap#256):
+
+| State | When |
+|---|---|
+| `required` | Laravel `->middleware('auth'…)` on the route, an enclosing `Route::middleware([...])->group(...)` / `Route::group(['middleware' => ...], ...)`, or the controller's `$this->middleware('auth')` (honouring `->only()` / `->except()`); Slim `->add($authMiddleware)` / `->add(new JwtAuthentication(...))` on the route or an enclosing `->group(...)`; Symfony `#[IsGranted]` / `#[Security]` on the action or its class, or a matching `security.yaml` `access_control` rule |
+| `anonymous` | Laravel `->withoutMiddleware('auth')` on the route or a group, or a controller `->except([...])` naming the action; Symfony `#[IsGranted('PUBLIC_ACCESS')]` or an `access_control` rule granting `PUBLIC_ACCESS` — when nothing else requires auth |
+| `unknown` | anything else |
+
+`access_control` is only applied to rules with literal `^/prefix` paths. A rule with `ips`, `host`, `allow_if` or a regex path stops resolution for the routes after it. Rules are matched against the full path (class and import prefixes joined); attribute routes under an import prefix that can't be read (a localized prefix map) are skipped. Laravel 11 `HasMiddleware::middleware()` controllers, Slim app-wide `$app->add(...)` and `can:` middleware aren't resolved.
+
+Outbound calls currently include patterns such as:
+
+- `curl_init("https://...")`
+- `file_get_contents("https://...")`
+- common HTTP client calls such as `->request(...)`, `->get(...)`, `->post(...)`
+
+Datastore/auth/secret hints are similarly heuristic and intended as first-pass signals. Secret hints are env var names (`getenv`, `$_ENV`, `$_SERVER`) containing `SECRET`, `TOKEN`, `KEY`, `PASSWORD` or `PASSWD`. `DB_HOST`-style connection settings are not secrets. `jwt` needs a JWT library (`Firebase\JWT\JWT`, `JWT::decode/encode`, `Lcobucci\JWT`, `tymon/jwt-auth`), and `auth` needs the `Auth::` facade or a chained `auth()->…` helper.
+
+## Installation
+
+```bash
+uv tool install attackmap --with attackmap-analyzer-php-web \
+  --index mlaify=https://pkg.mlaify.io/pypi/simple/ --index-strategy first-index
+# or from source:
+pip install git+https://github.com/mlaify/attackmap-analyzer-php-web.git
+```
+
+For local development:
+
+```bash
+pip install -e .[dev]
+```
+
+## Contract alignment with AttackMap core
+
+This package targets the current AttackMap analyzer contract:
+
+- analyzer exposes metadata via `metadata`
+- analyzer implements `detect(repo_path)` and `analyze(repo_path)`
+- `analyze` returns AttackMap-style structured scan data (`ScanResult` shape)
+
+The package includes a small compatibility layer so tests can run even if AttackMap core is not installed.
+
+## Future core discovery (documented, not implemented here)
+
+AttackMap core can discover this analyzer later via one of these options:
+
+1. entry points (preferred long-term)
+2. explicit configured analyzer list
+3. namespace/package scanning in `github.com/mlaify`
+
+This repository does not implement core-side discovery logic.
+
+## Limitations
+
+- regex-based extraction (not AST)
+- limited config route parsing; the Symfony YAML/XML readers cover the shapes Symfony's docs and recipes use, not full YAML/XML
+- Laravel route names (`->name()` / `'as'`), `Route::view` / `Route::redirect` / `Route::singleton`, and resource `->parameters([...])` renames aren't modelled
+- no framework-specific deep parsing yet
+- no dataflow or reachability modeling inside this analyzer
+
+These are deliberate to keep this first external analyzer incremental and maintainable.

attackmap_analyzer_php_web-0.2.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+attackmap_analyzer_php_web/__init__.py,sha256=WoyvHGSSsC39QiMB9Zi8L1G-yxxt7w2rM8pQitRr68E,130
+attackmap_analyzer_php_web/analyzer.py,sha256=BUoT7ilIluaGeaHiqFKyWccyRwmV3LhDusbJHRB59LQ,29588
+attackmap_analyzer_php_web/laravel_routes.py,sha256=xswEG7Y5s5FXAo4C4gNAxEz3TpB5xxd9QxPrXwtimfs,28661
+attackmap_analyzer_php_web/route_auth.py,sha256=nGhtPBJQUSa7Gu8h1CIfx1Aaa2YAFdd66V_kK_oMbZE,25606
+attackmap_analyzer_php_web/symfony_routes.py,sha256=7kcObkPOKpcCeDCJZzPnR3Pg5wsBWr6tTq8kWC7j-vA,17462
+attackmap_analyzer_php_web-0.2.0.dist-info/licenses/LICENSE,sha256=vtPQVGUyxq359j0JmD3_eJaXyHmaHyjzaMOtaLwJc88,1097
+attackmap_analyzer_php_web-0.2.0.dist-info/METADATA,sha256=t5-p4-DCQz8aGTkh1eB6hsLceSPKKccytjn700qyoZc,10236
+attackmap_analyzer_php_web-0.2.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+attackmap_analyzer_php_web-0.2.0.dist-info/entry_points.txt,sha256=GCrZaoTapBvwl8DNL0lM7yyvmvLL8qJmqQLGr8ekXMg,74
+attackmap_analyzer_php_web-0.2.0.dist-info/top_level.txt,sha256=2hL5g79YjmLnbFa4mkFsUoMmHqNGlcqLI2rb7d2iUWo,27
+attackmap_analyzer_php_web-0.2.0.dist-info/RECORD,,

attackmap_analyzer_php_web-0.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

attackmap_analyzer_php_web-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+php_web = attackmap_analyzer_php_web:PhpWebAnalyzer

attackmap_analyzer_php_web-0.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_php_web-0.2.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_php_web