Which socket transports a Phoenix endpoint actually enables.
Configuration is often assumed to be invisible to a bytecode analysis, and
for Application.get_env/2 at runtime it is. Phoenix.Endpoint's
socket/3 is a macro, so its options are compiled into the module —
__sockets__/0 is a single literal:
{:move, {:literal, [
{"/live", Phoenix.LiveView.Socket,
[websocket: [...], longpoll: [connect_info: [...]]]}]}, {:x, 0}}
:returnThat is the difference between a finding a human has to check against
endpoint.ex and one the analysis settles itself. The long-poll transport
starts a process per unauthenticated request with no ceiling, and it was
reported in three projects while being enabled in one.
A transport counts as enabled when its key is present and not false,
which is how Phoenix.Endpoint reads it.
Emitted facts
socket_transport(endpoint, path, transport)— an enabled transport