nccgroup / sobelow

Security-focused static analysis for the Phoenix Framework
Apache License 2.0
1.66k stars 92 forks source link

multiple routers (not an umbrella :) ) #109

Closed danturn closed 1 year ago

danturn commented 2 years ago

Heya,

Just wondering if sobelow might support our current setup or not,

we have a core router that proxies requests onto multiple other more traditional routers...

    use Plug.Router, init_mode: Application.compile_env(:phoenix, :plug_init_mode, :compile)
    plug :match
    plug :dispatch

    match("/:role/login", to: CommonWeb.Router)

we do have a router at lib/platform_web/router.ex but it one of a few...

it looks like you expect a single router?

im wondering

a) if my assumptions are right? and b) is there a way to make sure we're scanning all our routes?

i guess i can run multiple runs with a different --router param each time?

houllette commented 1 year ago

Hey @danturn! Sorry for the delay on this response - I looked into this and I believe that Sobelow will support multiple routers automatically like you explained.

Sobelow will initially look for the default router in the location that Phoenix initially establishes it, but Sobelow will still parse all files and conduct analysis to compile a list of all router files (seen here).