fix(reachability): seed PHP 8 attribute-routed handlers as entry points - #138
Merged
Conversation
gadievron
force-pushed
the
fix/php-attribute-route-seeding
branch
from
July 10, 2026 16:30
949916f to
f237d43
Compare
gadievron
added a commit
that referenced
this pull request
Jul 10, 2026
…eeded The TypeScript analyzer emitted function records with no 'decorators' field, so the reachability detector's decorator check (@Get/@Post/@controller in ENTRY_POINT_DECORATORS) could never fire for JS/TS. A NestJS/Angular handler identified only by a decorator (e.g. @get() findAll() { ... }) seeded zero entry points and its whole subtree was pruned from reachability — a false negative. Extract decorator source texts (method decorators plus the enclosing class's, so @controller is captured) via ts-morph getDecorators(), at ALL three class-member record sites: the class-declaration method loop, the class-expression method loop, and _emitAssignedFunction (an assigned method). Standalone-function record sites are left untouched because TS decorators cannot apply to them. The js reachable pipeline reads analyzer_output functions directly, so no normalization change is needed. JS sibling of the PHP #[Route] attribute-seeding fix (#138). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gadievron
added a commit
that referenced
this pull request
Jul 10, 2026
…eeded The TypeScript analyzer emitted function records with no 'decorators' field, so the reachability detector's decorator check (@Get/@Post/@controller in ENTRY_POINT_DECORATORS) could never fire for JS/TS. A NestJS/Angular handler identified only by a decorator (e.g. @get() findAll() { ... }) seeded zero entry points and its whole subtree was pruned from reachability — a false negative. Extract decorator source texts (method decorators plus the enclosing class's, so @controller is captured) via ts-morph getDecorators(), at ALL three class-member record sites: the class-declaration method loop, the class-expression method loop, and _emitAssignedFunction (an assigned method). Standalone-function record sites are left untouched because TS decorators cannot apply to them. The js reachable pipeline reads analyzer_output functions directly, so no normalization change is needed. JS sibling of the PHP #[Route] attribute-seeding fix (#138). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A Symfony/API-Platform handler marked with a routing attribute (#[Route], #[Get], #[Post], ...) on a class NOT named *Controller escaped the name/path route heuristic, so it was never seeded and its handler subtree was pruned from reachability — a real HTTP entry point, silently unreachable. - Capture PHP 8 attributes in the extractor and thread them into BOTH the call-graph record AND analyzer_output.json (unit_generator), because the per-parser reachable pipeline (parsers/php/test_pipeline.py) reads analyzer_output and normalizes units through a field whitelist that dropped decorators — so attribute detection silently no-opped on that path. - Classify a method carrying a routing attribute as route_handler independent of class name (Check-1c); match the attribute anywhere in the attribute list, case-insensitively (namespaced / grouped / lowercase forms). - Recognize Symfony request reads ($request->query->get(...), $request->get(...), $this->request->...) as user input, anchored to a request receiver so it does not fire on an ORM ->query->all() or a response ->headers->get(). Adds an end-to-end test that drives the full php reachable pipeline (not just the raw detector), which fails without the analyzer_output + whitelist changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gadievron
force-pushed
the
fix/php-attribute-route-seeding
branch
from
July 10, 2026 17:30
f237d43 to
5593289
Compare
gadievron
marked this pull request as ready for review
July 10, 2026 18:17
gadievron
requested review from
dgeyshis,
shahar-davidson and
sounil
as code owners
July 10, 2026 18:17
# Conflicts: # libs/openant-core/tests/parsers/php/test_php_extractor.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Symfony/API-Platform handler marked with a routing attribute (#[Route],
#[Get], #[Post], ...) on a class NOT named *Controller escaped the name/path
route heuristic, so it was never seeded and its whole handler subtree was
pruned from reachability (a real HTTP entry point, silently unreachable).
Capture PHP 8 attributes in the php extractor and classify a method carrying a
routing attribute as a route_handler independent of class name. Also recognize
Symfony request-bag reads ($request->query->get(...) etc.) as user input,
anchored to a $request/$req receiver so it does not fire on an ORM
->query->all() or a response ->headers->get().
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
Found by a deep reachability/call-graph validation of the parser corpus: the 2026 release fixed this bug class at some parser sites but left this sibling. Ships with a RED->GREEN regression test driving the real parser/detector pipeline (not a mock). One of a 9-PR series of independent, region-disjoint fixes; verified together (full suite green, no collisions).
🤖 Generated with Claude Code