Argus.Extractors.Endpoint (Panoptes v0.13.0)

Copy Markdown View Source

Which socket transports a Phoenix endpoint actually enables.

Configuration is often assumed to be invisible to a bytecode analysis, and for Application.get_env/2 at runtime it is. Phoenix.Endpoint's socket/3 is a macro, so its options are compiled into the module — __sockets__/0 is a single literal:

{:move, {:literal, [
  {"/live", Phoenix.LiveView.Socket,
    [websocket: [...], longpoll: [connect_info: [...]]]}]}, {:x, 0}}
:return

That is the difference between a finding a human has to check against endpoint.ex and one the analysis settles itself. The long-poll transport starts a process per unauthenticated request with no ceiling, and it was reported in three projects while being enabled in one.

A transport counts as enabled when its key is present and not false, which is how Phoenix.Endpoint reads it.

Emitted facts

  • socket_transport(endpoint, path, transport) — an enabled transport