class Analyzer::Scala::Cli

Overview

Surfaces the command-line attack surface of Scala programs as cli:// endpoints: scopt/decline (options/args/subcommands), Scallop (ScallopConf options/args/subcommands), com.twitter.app (flags), and sys.env reads. Line-scan, merged by URL.

Each library is gated on its own distinct import/marker, and only that library's regex family runs against the file. This matters because Scallop's bare opt[T]("name") call is textually identical to scopt's opt[T]("name") -- without per-library gating, scopt's extractor would also fire on Scallop code and attach subcommand-only flags to the root endpoint even though Scallop's own subcommand scoping correctly bound them to the subcommand.

Included Modules

Defined in:

analyzer/analyzers/scala/cli.cr

Constant Summary

CLI_TEST_PATH_RE = Regex.union("/test/", "/it/", "spec.scala", "test.scala")

One precompiled Regex.union scan (PCRE2 JIT) replaces four separate String#includes? scans of the same buffer -- Crystal's includes? is not Boyer-Moore accelerated, so a single regex pass over lower is cheaper than four. Equivalent to the OR-of-substrings it replaces (union escapes each literal).

DEC_ARG = /\bOpts\.argument(?:\[[^\]]*\])?\s*\(\s*"<?([A-Za-z0-9][\w-]*)>?"/
DEC_CMD = /\bCommand\s*\(\s*"([^"]+)"/
DEC_FLAG = /\bOpts\.flag\s*\(\s*"([^"]+)"/
DEC_OPT = /\bOpts\.option\[[^\]]*\]\s*\(\s*"([^"]+)"/
MARKERS = /\bscopt\b|\bOParser\b|\bcom\.monovore\.decline\b|\bOpts\.(?:option|flag|argument|arguments)\b|\bmainargs\b|\borg\.rogach\.scallop\b|\bScallopConf\b|\bcom\.twitter\.app\b/
SCALLOP_ARG_INFERRED = /\bval\s+(\w+)\s*=\s*trailArg\[[^\]]*\]\s*\(\s*(?!")/
SCALLOP_ARG_NAMED = /\btrailArg\[[^\]]*\]\s*\(\s*"([^"]+)"/
SCALLOP_MARKER = /\borg\.rogach\.scallop\b|\bScallopConf\b/
SCALLOP_OPT_INFERRED = /\bval\s+(\w+)\s*=\s*opt\[[^\]]*\]\s*\(\s*(?!")/
SCALLOP_OPT_NAMED = /\bopt\[[^\]]*\]\s*\(\s*"([^"]+)"/
SCALLOP_SUBCMD = /\b(?:val\s+\w+\s*=\s*(?:new\s+)?Subcommand\s*\(\s*"([^"]+)"|object\s+\w+\s+extends\s+Subcommand\s*\(\s*"([^"]+)")/

--- Scallop (org.rogach.scallop) ----------------------------------- opt[T]/trailArg[T] take an explicit name, or (via a Scallop macro) infer it from the enclosing val when the name is omitted -- this is a real, documented Scallop feature, unlike com.twitter.app's flag.

Subcommands are declared either as val x = (new )?Subcommand("name") { ... } or the idiomatic object x extends Subcommand("name") { ... } shown in Scallop's own docs; both open their scope with a { on the same line, closed via brace-depth tracking.

SCOPT_ARG = /\barg\[[^\]]*\]\s*\(\s*"<?([A-Za-z0-9][\w-]*)>?"/
SCOPT_CMD = /\bcmd\s*\(\s*"([^"]+)"/
SCOPT_DECLINE_MARKER = /\bscopt\b|\bOParser\b|\bcom\.monovore\.decline\b|\bOpts\.(?:option|flag|argument|arguments)\b|\bmainargs\b/
SCOPT_OPT = /\bopt\[[^\]]*\]\s*\(\s*(?:'[A-Za-z0-9]'\s*,\s*)?"([^"]+)"/

--- scopt / decline -----------------------------------------------

SYS_ENV = /\bsys\.env\s*(?:\(\s*"([^"]+)"|\.get\s*\(\s*"([^"]+)")/
TWITTER_FLAG = /\bflag\[[^\]]*\]\s*\(\s*"([^"]+)"/

--- com.twitter.app -------------------------------------------------- flag[T]("name", ...) always requires an explicit name -- there is no reflection/macro-based no-arg overload the way Scallop infers names from a val, so only the explicitly-named form is extracted.

TWITTER_MARKER = /\bcom\.twitter\.app\b/
WEB_RE = /\bimport\s+(?:akka\.http|play\.api|org\.http4s|cask|com\.twitter\.finatra|com\.linecorp\.armeria|zhttp|zio\.http)\b/

Class Method Summary

Instance Method Summary

Instance methods inherited from class Analyzer

analyze analyze, base_path : String base_path, base_paths : Array(String) base_paths, base_relative_path(path : String) : String base_relative_path, callees_needed? : Bool callees_needed?, content_matches?(content : String, markers : Regex) : Bool content_matches?, http_header_name(name : String) : String | Nil http_header_name, line_number_for_index(content : String, char_index : Int32) : Int32 line_number_for_index, logger : NoirLogger logger, parallel_analyze(files : Array(String), &block : String -> Nil) parallel_analyze, read_file_content(path : String) : String read_file_content, result : Array(Endpoint) result, tech : String tech, unique_params(params : Array(Param)) : Array(Param) unique_params, url : String url, web_root_path(path : String, markers : Array(String)) : String web_root_path

Constructor methods inherited from class Analyzer

new(options : Hash(String, YAML::Any)) new

Macros inherited from class Analyzer

analyzer_for(tech) analyzer_for

Instance methods inherited from module FileHelper

all_files : Array(String) all_files, get_files_by_basename(basename : String) : Array(String) get_files_by_basename, get_files_by_extension(extension : String) : Array(String) get_files_by_extension, get_files_by_extensions(extensions : Array(String)) : Array(String) get_files_by_extensions, get_files_by_prefix(prefix : String) : Array(String) get_files_by_prefix, get_files_by_prefix_and_extension(prefix : String, extension : String) : Array(String) get_files_by_prefix_and_extension, get_files_by_relative_path(relative_path : String, root : String = "") : Array(String) get_files_by_relative_path, get_public_dir_files(base_path : String, folder : String) : Array(String) get_public_dir_files, get_public_files(base_path : String, anchors : Array(String) = ["shard.yml", "Gemfile"]) : Array(String) get_public_files, walked_path(expanded : String) : String walked_path

Class Method Detail

def self.tech_name : String #

[View source]

Instance Method Detail

def analyze #

[View source]
def tech : String #

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.


[View source]