attackmap-analyzer-php-web 0.2.0__tar.gz

attackmap_analyzer_php_web-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_php_web-0.2.0/PKG-INFO

@@ -0,0 +1,160 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-php-web
+Version: 0.2.0
+Summary: Broad PHP web analyzer plugin for AttackMap
+Author: AttackMap Contributors
+Author-email: Matthew Davis <mlaify@mlaify.io>
+Maintainer-email: Matthew Davis <mlaify@mlaify.io>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-php-web
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-php-web
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-php-web/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-php-web/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.6.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.6.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-php-web
+
+> [!IMPORTANT]
+> **Active development, slow pace.** AttackMap is under active development, but
+> progress may be slow until more contributors or co-maintainers join. Help is
+> very welcome with the core engine, an analyzer, the macOS app, or the docs —
+> see [CONTRIBUTING.md](CONTRIBUTING.md) or open an issue on
+> [mlaify/AttackMap](https://github.com/mlaify/AttackMap/issues) to say hello.
+> Security reports are still welcome at [security@mlaify.io](mailto:security@mlaify.io).
+
+Broad PHP web analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This repository is intentionally separate from AttackMap core. It focuses only on extracting structured signals from PHP repositories:
+
+- routes
+- outbound HTTP calls
+- datastore hints
+- auth hints
+- secret and env usage
+
+It does not render reports and does not own global severity policy.
+
+## Analyzer identity
+
+- `name`: `php-web`
+- `display_name`: `PHP Web Analyzer`
+- `version`: `0.1.0`
+- `experimental`: `true`
+- `enabled_by_default`: `false`
+
+## Scope
+
+This analyzer is broad and heuristic. It is meant to map common PHP web application surfaces before framework-specific analyzers (for example `php-laminas` or `omeka-s`) are added.
+
+## Detection strategy
+
+`detect(repo_path)` uses lightweight signals:
+
+- `composer.json` present, or
+- at least one `.php` file outside `vendor/` (and the other shared skip dirs)
+
+A `src/`, `app/` or `config/` directory on its own is not enough, since Python, Go and Java repos have those too.
+
+## Extraction strategy
+
+`analyze(repo_path)` scans `.php` files and emits structured signals using regular-expression heuristics.
+
+Route extraction currently includes patterns such as:
+
+- Laravel `Route::get|post|put|patch|delete|options|head|any(...)`, array-first `Route::match(['get', 'post'], ...)`, and a scope chained before the verb (`Route::middleware('auth')->get(...)`). `Route::resource` / `apiResource` / `resources` / `apiResources` expand to their REST routes (7 / 5 actions; `update` is `PUT` and `PATCH`), honouring `->only()` / `->except()` / `->shallow()`, an `['only' => ...]` options array and nested `photos.comments` names.
+- Laravel groups: `Route::prefix('admin')->middleware(...)->group(function () { ... })` and `Route::group(['prefix' => ..., 'middleware' => ...], fn)` join their prefixes onto the routes inside, at any nesting depth up to 32. `Route::controller(C::class)->group(...)` dispatches bare method names to `C`.
+- Laravel route files take the prefix and middleware of the group that loads them: `->group(base_path('routes/admin.php'))`, `require base_path(...)` / `$this->loadRoutesFrom(__DIR__.'/...')` inside a group, and `withRouting(api: ... | [...], apiPrefix: ...)` in `bootstrap/app.php`. `routes/api.php` defaults to `/api` when nothing outside test code mounts it. A `require_once` that loops back to a file already being loaded is a no-op. A `config('file.key')` prefix is read from `config/file.php` (a literal or an `env()` default), and any other non-literal prefix becomes a `{prefix}` segment.
+- `$app->get('/path', ...)` / `$app->map(['GET', 'POST'], '/path', ...)` Slim calls. The path must start with `/`, and the receiver must be `$app`, `$router`, `$route`, `$group` or `$r`, a variable assigned from `AppFactory::create()` / `new RouteCollector` / `new App`, or a parameter typed `RouteCollectorProxy` / `RouteCollector` / `App`. This keeps `$request->get('id')` and `$cache->get('k')` out. Slim `$app->group('/v1', ...)` and Lumen `$router->group(['prefix' => 'api'], ...)` prefixes are joined.
+- Symfony `#[Route('/path', methods: ['GET'])]` (or `path:`) attributes, joined onto the class-level `#[Route('/prefix')]` (whose `methods` merge in). A class-level route is a route of its own only on a controller with no routed actions (`__invoke`).
+- Symfony route config, loaded in the kernel's order (`config/routes/*.yaml` sorted, then `config/routes.yaml`; plus Symfony 2/3's `app/config/routing.yml`; other files only when imported): `path` / `methods` entries, and `resource` imports with a `prefix`, applied to attribute controllers under the imported directory (or `routing.controllers`, i.e. `src/`) or to an imported local route file. A later import of the same controllers or route file with the same `name_prefix` replaces the earlier one (Symfony keys routes by name), so each route is reported once per distinct name prefix, under the last import's prefix. A localized prefix map becomes a `{prefix}` segment. Localized path maps and `when@dev` / `when@test` blocks are skipped.
+- config-style `"path" => "/..."`, only in files that also declare a `'routes'` / `'router'` key (so Laravel's `config/logging.php` paths aren't routes)
+
+Brackets are matched in one string-, comment- and heredoc-aware pass per file, so a commented-out `Route::get(...)` is not a route and a `}` inside a string doesn't end a group.
+
+Each route carries `auth`, `guards` and `guard_evidence` (AttackMap#256):
+
+| State | When |
+|---|---|
+| `required` | Laravel `->middleware('auth'…)` on the route, an enclosing `Route::middleware([...])->group(...)` / `Route::group(['middleware' => ...], ...)`, or the controller's `$this->middleware('auth')` (honouring `->only()` / `->except()`); Slim `->add($authMiddleware)` / `->add(new JwtAuthentication(...))` on the route or an enclosing `->group(...)`; Symfony `#[IsGranted]` / `#[Security]` on the action or its class, or a matching `security.yaml` `access_control` rule |
+| `anonymous` | Laravel `->withoutMiddleware('auth')` on the route or a group, or a controller `->except([...])` naming the action; Symfony `#[IsGranted('PUBLIC_ACCESS')]` or an `access_control` rule granting `PUBLIC_ACCESS` — when nothing else requires auth |
+| `unknown` | anything else |
+
+`access_control` is only applied to rules with literal `^/prefix` paths. A rule with `ips`, `host`, `allow_if` or a regex path stops resolution for the routes after it. Rules are matched against the full path (class and import prefixes joined); attribute routes under an import prefix that can't be read (a localized prefix map) are skipped. Laravel 11 `HasMiddleware::middleware()` controllers, Slim app-wide `$app->add(...)` and `can:` middleware aren't resolved.
+
+Outbound calls currently include patterns such as:
+
+- `curl_init("https://...")`
+- `file_get_contents("https://...")`
+- common HTTP client calls such as `->request(...)`, `->get(...)`, `->post(...)`
+
+Datastore/auth/secret hints are similarly heuristic and intended as first-pass signals. Secret hints are env var names (`getenv`, `$_ENV`, `$_SERVER`) containing `SECRET`, `TOKEN`, `KEY`, `PASSWORD` or `PASSWD`. `DB_HOST`-style connection settings are not secrets. `jwt` needs a JWT library (`Firebase\JWT\JWT`, `JWT::decode/encode`, `Lcobucci\JWT`, `tymon/jwt-auth`), and `auth` needs the `Auth::` facade or a chained `auth()->…` helper.
+
+## Installation
+
+```bash
+uv tool install attackmap --with attackmap-analyzer-php-web \
+  --index mlaify=https://pkg.mlaify.io/pypi/simple/ --index-strategy first-index
+# or from source:
+pip install git+https://github.com/mlaify/attackmap-analyzer-php-web.git
+```
+
+For local development:
+
+```bash
+pip install -e .[dev]
+```
+
+## Contract alignment with AttackMap core
+
+This package targets the current AttackMap analyzer contract:
+
+- analyzer exposes metadata via `metadata`
+- analyzer implements `detect(repo_path)` and `analyze(repo_path)`
+- `analyze` returns AttackMap-style structured scan data (`ScanResult` shape)
+
+The package includes a small compatibility layer so tests can run even if AttackMap core is not installed.
+
+## Future core discovery (documented, not implemented here)
+
+AttackMap core can discover this analyzer later via one of these options:
+
+1. entry points (preferred long-term)
+2. explicit configured analyzer list
+3. namespace/package scanning in `github.com/mlaify`
+
+This repository does not implement core-side discovery logic.
+
+## Limitations
+
+- regex-based extraction (not AST)
+- limited config route parsing; the Symfony YAML/XML readers cover the shapes Symfony's docs and recipes use, not full YAML/XML
+- Laravel route names (`->name()` / `'as'`), `Route::view` / `Route::redirect` / `Route::singleton`, and resource `->parameters([...])` renames aren't modelled
+- no framework-specific deep parsing yet
+- no dataflow or reachability modeling inside this analyzer
+
+These are deliberate to keep this first external analyzer incremental and maintainable.

attackmap_analyzer_php_web-0.2.0/README.md

@@ -0,0 +1,121 @@
+# attackmap-analyzer-php-web
+
+> [!IMPORTANT]
+> **Active development, slow pace.** AttackMap is under active development, but
+> progress may be slow until more contributors or co-maintainers join. Help is
+> very welcome with the core engine, an analyzer, the macOS app, or the docs —
+> see [CONTRIBUTING.md](CONTRIBUTING.md) or open an issue on
+> [mlaify/AttackMap](https://github.com/mlaify/AttackMap/issues) to say hello.
+> Security reports are still welcome at [security@mlaify.io](mailto:security@mlaify.io).
+
+Broad PHP web analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This repository is intentionally separate from AttackMap core. It focuses only on extracting structured signals from PHP repositories:
+
+- routes
+- outbound HTTP calls
+- datastore hints
+- auth hints
+- secret and env usage
+
+It does not render reports and does not own global severity policy.
+
+## Analyzer identity
+
+- `name`: `php-web`
+- `display_name`: `PHP Web Analyzer`
+- `version`: `0.1.0`
+- `experimental`: `true`
+- `enabled_by_default`: `false`
+
+## Scope
+
+This analyzer is broad and heuristic. It is meant to map common PHP web application surfaces before framework-specific analyzers (for example `php-laminas` or `omeka-s`) are added.
+
+## Detection strategy
+
+`detect(repo_path)` uses lightweight signals:
+
+- `composer.json` present, or
+- at least one `.php` file outside `vendor/` (and the other shared skip dirs)
+
+A `src/`, `app/` or `config/` directory on its own is not enough, since Python, Go and Java repos have those too.
+
+## Extraction strategy
+
+`analyze(repo_path)` scans `.php` files and emits structured signals using regular-expression heuristics.
+
+Route extraction currently includes patterns such as:
+
+- Laravel `Route::get|post|put|patch|delete|options|head|any(...)`, array-first `Route::match(['get', 'post'], ...)`, and a scope chained before the verb (`Route::middleware('auth')->get(...)`). `Route::resource` / `apiResource` / `resources` / `apiResources` expand to their REST routes (7 / 5 actions; `update` is `PUT` and `PATCH`), honouring `->only()` / `->except()` / `->shallow()`, an `['only' => ...]` options array and nested `photos.comments` names.
+- Laravel groups: `Route::prefix('admin')->middleware(...)->group(function () { ... })` and `Route::group(['prefix' => ..., 'middleware' => ...], fn)` join their prefixes onto the routes inside, at any nesting depth up to 32. `Route::controller(C::class)->group(...)` dispatches bare method names to `C`.
+- Laravel route files take the prefix and middleware of the group that loads them: `->group(base_path('routes/admin.php'))`, `require base_path(...)` / `$this->loadRoutesFrom(__DIR__.'/...')` inside a group, and `withRouting(api: ... | [...], apiPrefix: ...)` in `bootstrap/app.php`. `routes/api.php` defaults to `/api` when nothing outside test code mounts it. A `require_once` that loops back to a file already being loaded is a no-op. A `config('file.key')` prefix is read from `config/file.php` (a literal or an `env()` default), and any other non-literal prefix becomes a `{prefix}` segment.
+- `$app->get('/path', ...)` / `$app->map(['GET', 'POST'], '/path', ...)` Slim calls. The path must start with `/`, and the receiver must be `$app`, `$router`, `$route`, `$group` or `$r`, a variable assigned from `AppFactory::create()` / `new RouteCollector` / `new App`, or a parameter typed `RouteCollectorProxy` / `RouteCollector` / `App`. This keeps `$request->get('id')` and `$cache->get('k')` out. Slim `$app->group('/v1', ...)` and Lumen `$router->group(['prefix' => 'api'], ...)` prefixes are joined.
+- Symfony `#[Route('/path', methods: ['GET'])]` (or `path:`) attributes, joined onto the class-level `#[Route('/prefix')]` (whose `methods` merge in). A class-level route is a route of its own only on a controller with no routed actions (`__invoke`).
+- Symfony route config, loaded in the kernel's order (`config/routes/*.yaml` sorted, then `config/routes.yaml`; plus Symfony 2/3's `app/config/routing.yml`; other files only when imported): `path` / `methods` entries, and `resource` imports with a `prefix`, applied to attribute controllers under the imported directory (or `routing.controllers`, i.e. `src/`) or to an imported local route file. A later import of the same controllers or route file with the same `name_prefix` replaces the earlier one (Symfony keys routes by name), so each route is reported once per distinct name prefix, under the last import's prefix. A localized prefix map becomes a `{prefix}` segment. Localized path maps and `when@dev` / `when@test` blocks are skipped.
+- config-style `"path" => "/..."`, only in files that also declare a `'routes'` / `'router'` key (so Laravel's `config/logging.php` paths aren't routes)
+
+Brackets are matched in one string-, comment- and heredoc-aware pass per file, so a commented-out `Route::get(...)` is not a route and a `}` inside a string doesn't end a group.
+
+Each route carries `auth`, `guards` and `guard_evidence` (AttackMap#256):
+
+| State | When |
+|---|---|
+| `required` | Laravel `->middleware('auth'…)` on the route, an enclosing `Route::middleware([...])->group(...)` / `Route::group(['middleware' => ...], ...)`, or the controller's `$this->middleware('auth')` (honouring `->only()` / `->except()`); Slim `->add($authMiddleware)` / `->add(new JwtAuthentication(...))` on the route or an enclosing `->group(...)`; Symfony `#[IsGranted]` / `#[Security]` on the action or its class, or a matching `security.yaml` `access_control` rule |
+| `anonymous` | Laravel `->withoutMiddleware('auth')` on the route or a group, or a controller `->except([...])` naming the action; Symfony `#[IsGranted('PUBLIC_ACCESS')]` or an `access_control` rule granting `PUBLIC_ACCESS` — when nothing else requires auth |
+| `unknown` | anything else |
+
+`access_control` is only applied to rules with literal `^/prefix` paths. A rule with `ips`, `host`, `allow_if` or a regex path stops resolution for the routes after it. Rules are matched against the full path (class and import prefixes joined); attribute routes under an import prefix that can't be read (a localized prefix map) are skipped. Laravel 11 `HasMiddleware::middleware()` controllers, Slim app-wide `$app->add(...)` and `can:` middleware aren't resolved.
+
+Outbound calls currently include patterns such as:
+
+- `curl_init("https://...")`
+- `file_get_contents("https://...")`
+- common HTTP client calls such as `->request(...)`, `->get(...)`, `->post(...)`
+
+Datastore/auth/secret hints are similarly heuristic and intended as first-pass signals. Secret hints are env var names (`getenv`, `$_ENV`, `$_SERVER`) containing `SECRET`, `TOKEN`, `KEY`, `PASSWORD` or `PASSWD`. `DB_HOST`-style connection settings are not secrets. `jwt` needs a JWT library (`Firebase\JWT\JWT`, `JWT::decode/encode`, `Lcobucci\JWT`, `tymon/jwt-auth`), and `auth` needs the `Auth::` facade or a chained `auth()->…` helper.
+
+## Installation
+
+```bash
+uv tool install attackmap --with attackmap-analyzer-php-web \
+  --index mlaify=https://pkg.mlaify.io/pypi/simple/ --index-strategy first-index
+# or from source:
+pip install git+https://github.com/mlaify/attackmap-analyzer-php-web.git
+```
+
+For local development:
+
+```bash
+pip install -e .[dev]
+```
+
+## Contract alignment with AttackMap core
+
+This package targets the current AttackMap analyzer contract:
+
+- analyzer exposes metadata via `metadata`
+- analyzer implements `detect(repo_path)` and `analyze(repo_path)`
+- `analyze` returns AttackMap-style structured scan data (`ScanResult` shape)
+
+The package includes a small compatibility layer so tests can run even if AttackMap core is not installed.
+
+## Future core discovery (documented, not implemented here)
+
+AttackMap core can discover this analyzer later via one of these options:
+
+1. entry points (preferred long-term)
+2. explicit configured analyzer list
+3. namespace/package scanning in `github.com/mlaify`
+
+This repository does not implement core-side discovery logic.
+
+## Limitations
+
+- regex-based extraction (not AST)
+- limited config route parsing; the Symfony YAML/XML readers cover the shapes Symfony's docs and recipes use, not full YAML/XML
+- Laravel route names (`->name()` / `'as'`), `Route::view` / `Route::redirect` / `Route::singleton`, and resource `->parameters([...])` renames aren't modelled
+- no framework-specific deep parsing yet
+- no dataflow or reachability modeling inside this analyzer
+
+These are deliberate to keep this first external analyzer incremental and maintainable.

attackmap_analyzer_php_web-0.2.0/pyproject.toml

@@ -0,0 +1,74 @@
+[build-system]
+requires = ["setuptools>=77", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "attackmap-analyzer-php-web"
+version = "0.2.0"
+description = "Broad PHP web analyzer plugin for AttackMap"
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [
+  {name = "Matthew Davis", email = "mlaify@mlaify.io"},
+  {name = "AttackMap Contributors"},
+]
+maintainers = [
+  {name = "Matthew Davis", email = "mlaify@mlaify.io"},
+]
+keywords = [
+  "security",
+  "static-analysis",
+  "appsec",
+  "defensive-security",
+  "attackmap",
+  "attackmap-plugin",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "Intended Audience :: Information Technology",
+  "Intended Audience :: System Administrators",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security",
+  "Topic :: Software Development :: Quality Assurance",
+  "Typing :: Typed",
+]
+dependencies = [
+  "pydantic>=2.7.0",
+]
+
+[project.optional-dependencies]
+core = [
+  "attackmap>=0.6.0",
+]
+dev = [
+  "pytest>=8.0.0",
+  "build>=1.2.0",
+  "attackmap>=0.6.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/mlaify/attackmap-analyzer-php-web"
+Repository = "https://github.com/mlaify/attackmap-analyzer-php-web"
+Issues = "https://github.com/mlaify/attackmap-analyzer-php-web/issues"
+Changelog = "https://github.com/mlaify/attackmap-analyzer-php-web/blob/main/CHANGELOG.md"
+"AttackMap core" = "https://github.com/mlaify/AttackMap"
+
+[project.entry-points."attackmap.analyzers"]
+php_web = "attackmap_analyzer_php_web:PhpWebAnalyzer"
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

attackmap_analyzer_php_web-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

attackmap_analyzer_php_web-0.2.0/src/attackmap_analyzer_php_web/__init__.py

@@ -0,0 +1,4 @@
+from .analyzer import PhpWebAnalyzer
+from attackmap.sdk import AnalyzerMetadata
+
+__all__ = ["AnalyzerMetadata", "PhpWebAnalyzer"]