Argus.Extractors.Router (Panoptes v0.13.0)

Copy Markdown View Source

The HTTP routes a Phoenix router declares.

Phoenix.Router compiles __routes__/0 to a single literal — one map per route, with path, verb, plug and plug_opts:

%{path: "/public/health", plug: LivebookWeb.HealthController,
  plug_opts: :index, verb: :get, ...}

Analyses that reach a request entry point can only say reachable from a plug entry point without this. With it they can say reachable from GET /public/sessions/:id/assets/..., which is the difference between a reader trusting a severity and going to check it themselves.

pipe_through is deliberately absent: Phoenix compiles pipelines into the router's dispatch function as control flow rather than into this literal, so is this route authenticated is derivable but not from here. The path is often a good proxy — projects that segregate public routes do it by prefix — and that judgement belongs to whoever reads the finding.

Emitted facts

  • http_route(router, verb, path, plug, action)