class Analyzer::Php::Wordpress

• Analyzer::Php::Wordpress
• Analyzer::Php::PhpEngine
• FileScanEngine
• Analyzer
• Reference
• Object

Overview

WordPress attack-surface extractor.

WordPress does not expose a conventional route table; its HTTP surface is registered imperatively through a handful of well-known APIs:

• REST API — register_rest_route( $namespace, $route, $args ) served under /wp-json/{namespace}/{route}.
• Admin AJAX — add_action( 'wp_ajax_{action}', ... ) and the public wp_ajax_nopriv_{action} variant, dispatched by /wp-admin/admin-ajax.php?action={action}.
• Admin POST — add_action( 'admin_post_{action}', ... ) / admin_post_nopriv_{action}, dispatched by /wp-admin/admin-post.php?action={action}.

Defined in:

Constant Summary

ADMIN_AJAX_PATH = "/wp-admin/admin-ajax.php"

ADMIN_POST_PATH = "/wp-admin/admin-post.php"

ALL_HTTP_VERBS = ["GET", "POST", "PUT", "PATCH", "DELETE"]

DISPATCH_METHODS = ["GET", "POST"]

WordPress admin-ajax / admin-post dispatch on $_REQUEST['action'], so both verbs are valid entry points.

REST_METHOD_CONSTANTS = {"READABLE" => ["GET"], "CREATABLE" => ["POST"], "EDITABLE" => ["POST", "PUT", "PATCH"], "DELETABLE" => ["DELETE"], "ALLMETHODS" => ["GET", "POST", "PUT", "PATCH", "DELETE"]}

WP_REST_Server:: method-group constants → concrete HTTP verbs.

SPLIT_ARGS_RULES = Noir::TopLevelSplit::Rules.new(nest: (Noir::TopLevelSplit::Nest::Paren | Noir::TopLevelSplit::Nest::Bracket) | Noir::TopLevelSplit::Nest::Brace, quotes: "\"'", escape: Noir::TopLevelSplit::Escape::InQuotes, strip: false, empties: Noir::TopLevelSplit::Empties::DropTrailing, per_kind: false, clamp: false)

Rules::SHARED_DEPTH_RAW with a trailing empty dropped and, like erlang/cowboy.cr, WITHOUT clamping: the body this replaces closed brackets with a bare depth -= 1, so a fragment beginning with a closer (")x, y") drives depth negative and stops splitting. That is observable on the regex-sliced input this actually receives, so it is preserved rather than normalised.

File-local because wordpress is the only splitter pairing clamp: false with unstripped parts.

Class Method Summary

• .tech_name : String

Instance Method Summary

• #analyze_file(path : String) : Array(Endpoint)
• #tech : String

  Instance-side view of the same declaration.

Class Method Detail

Instance Method Detail