php-route-mapper

PHP Source Code Route & Param Mapper

Analyze PHP web project source code, extractcompleteHTTP route entries and request parameter structures, generate request templates usable for security testing (Burp/Repeater style), and automatically save as Markdown.

CRITICAL: Complete output (mandatory)

This skill must output all discovered routes and interfaces, omission is not allowed:

• Omission placeholders are prohibited; complete route and parameter content must be output
• Outputting only "key routes/important routes" is prohibited
• Each route must include: HTTP method, path rule, handler location, complete parameter structure, complete request template (inside a code block)

Core input

User provides:

• source_path: PHP project source code root directory Optional:
• context_path: if a reverse proxy/gateway prefix exists, it can be used to concatenate the full path (must have an evidence source)

Output directory structure (recommended)

{output_path}/
├── route_mapping/
│   ├── routes_{timestamp}.md
│   └── params_{timestamp}.md
└── quality/
    └── route_mapper_validation_{timestamp}.md

For the correspondence under path and pipeline merge mode, see shared/IO_PATH_CONVENTION.md（route_mapping/*.md is equivalent to the "Routes/Parameters" section in the report).

Identification scope (mandatory)

1. Route configuration/definition (identified by framework)
   • Laravel：routes/web.php、routes/api.php、Route::get/post/{subpath}、Route::resource, Route group prefixes and middleware
   • Symfony：config/routes/*、PHP8 attribute #[Route({route_options})]、Annotation @Route({route_options})
   • Slim：$app->get/post/any({handler}), custom middleware
   • WordPress：admin-post.php/admin-ajax.php、add_action('admin_post_*')、add_action('wp_ajax_*')
   • Pure PHP: front controller (e.g. public/index.php) dispatch logic, $_SERVER['REQUEST_URI'] -based route matching
2. Dynamic routes/parameterized routes (mandatory)
   • {id} / (?P<id>{id_pattern}) / regex routes: controllable parameters must be listed
   • Route constraints (where/regex limit): constraint rules and controllability boundaries must be output

Parameter structure parsing (mandatory)

For each route, output the following parameter source and type information:

• Path parameters: placeholders from the route rule (output such as {id}）
• Query parameters:$_GET / request()->query({query}) / framework query parsing results
• Body parameters:php://input、$_POST、JSON json_decode({json})
• Header parameters:getallheaders()、$_SERVER[{value}], framework request header API
• Cookie parameters:$_COOKIE
• File parameters:$_FILES(output field name and filename source)

Handler location (mandatory)

Each route must provide handler source evidence:

• File path (relative/absolute is acceptable, but must be consistent)
• Function/class/method signature (a name that can be located in the source code)
• Key dispatch point: how route matching enters the handler (e.g. switch case / include file chain)

Output format (mandatory)

routes_{timestamp}.md: Main index (listed one by one)

Note: this skill uses routes_{timestamp}.md in === [N] {route_summary} === the N as HTTP routethe route_id(used later in the pipeline for route_tracer/{route_id}/trace_{timestamp}.md file bucketing).CLI / hook / sink-only and other synthetic route_id are written by php-audit-pipeline stage 3 into high_risk_routes_{timestamp}.md，does notoccupy the [N] sequence number of this file.

# {project_name} - 路由与接口索引（PHP）
生成时间: {timestamp}
分析路径: {source_path}

## 路由清单（全部）
=== [1] GET /path/to/{id} ===
HTTP 方法: GET
路由路径规则: /path/to/{id}
处理器: ControllerClass@method / functionName
位置: path/to/file.php:line（若无法获取行号，标注“待定位：需人工打开文件确认”但仍给出文件路径）
参数概览:
  Path: id (类型推断/约束)
  Query: {query_params}

=== [2] POST /path/to/{id}/action ===
HTTP 方法: POST
路由路径规则: /path/to/{id}/action
处理器: ControllerClass@action / functionName
位置: path/to/file.php:line（若无法获取行号，标注“待定位：需人工打开文件确认”但仍给出文件路径）
参数概览:
  Path: id (类型推断/约束)
  Query: {query_params}

params_{timestamp}.md: Parameter details (listed one by one)

# {project_name} - 路由参数结构（逐条）
生成时间: {timestamp}

=== 路由: GET /path/to/{id} ===
1) Path 参数
| 参数 | 类型/约束 | 位置 | 必填 |
|------|------------|------|------|
| id   | int/regex{id_pattern} | Router rule | 是/否/不确定 |

2) Query 参数
| 参数 | 类型 | 来源 | 必填 | 说明 |

3) Body 参数（如 JSON）
| 字段 | 类型 | JSON 路径 | 必填 |

4) Header/ Cookie / File（如有）
| 字段 | 类型 | 来源 | 必填 |

5) 完整请求模板（必须在代码块里）
```http
GET /path/to/{id}?a={a}&b={b} HTTP/1.1
Host: {host}
Cookie: {cookie}
Authorization: Bearer {token}
Content-Type: application/json

{"k":"{v}"}

## 输出前自检（强制）
- [ ] routes 与 params 中每条路由“序号/路由标识”一致
- [ ] 没有出现省略占位符
- [ ] 每条路由都有“完整请求模板”代码块