Upd. Scan. Improve check included files.

[svfcode]

task https://app.doboard.com/1/task/36879

[Copilot]

Pull request overview

This PR improves scanner behavior around included files and end-of-stage handling, aiming to prevent scan-loop freezes and to better detect/queue include targets that aren’t straightforward string literals.

Changes:

• Prevents the filesystem analysis stage from stalling the frontend when the last chunk is empty by returning an explicit “end” payload.
• Enhances heuristic include-path extraction to resolve safe concatenations (e.g., ABSPATH . 'file.php', __DIR__ . '/file') by seeding known CMS constants and supporting __DIR__ replacement.
• Extends heuristic-stage handling of include targets by resetting recheck flags for non-PHP includes and running signatures inline for those cases.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
lib/CleantalkSP/SpbctWP/Scanner/ScannerQueue.php	Fixes end-of-stage output for empty chunks; improves include target path normalization and recheck/signature handling for non-PHP includes.
lib/CleantalkSP/Common/Scanner/HeuristicAnalyser/Modules/Variables.php	Seeds known CMS constants and supports __DIR__ replacement for include resolution.
lib/CleantalkSP/Common/Scanner/HeuristicAnalyser/Modules/Includes.php	Reworks include argument parsing to resolve safe concatenations and canonicalize paths.
lib/CleantalkSP/Common/Scanner/HeuristicAnalyser/Modules/CodeStyle.php	Makes PHP open-tag detection more robust (tokenizer newline behavior).
lib/CleantalkSP/Common/Scanner/HeuristicAnalyser/HeuristicAnalyser.php	Wires constant seeding into heuristic analyzer initialization.

Comments suppressed due to low confidence (1)

lib/CleantalkSP/Common/Scanner/HeuristicAnalyser/Modules/Includes.php:165

• $properties['status'] is currently computed using ! $properties['not_url'], which marks all non-URL (local filesystem) includes as status === false. Since ScannerQueue::heuristic_analysis() enqueues includes when status === false && exists, this can cause a large number of normal local includes to be enqueued unexpectedly. Use $properties['not_url'] here (true for non-URL paths).

        // Gather result in one flag
        $properties['status'] = $properties['good'] && ! $properties['not_url'] && $properties['ext_good'];

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

lib/CleantalkSP/Common/Scanner/HeuristicAnalyser/Modules/Includes.php:195

• extractPathFromIncludeTokens() strips wrapping parentheses before removing whitespace. For includes like include('a.php') ; (whitespace before ;), the last token is T_WHITESPACE so the closing ) isn't detected, parentheses aren't stripped, and the path becomes unresolved. Remove whitespace first, then strip outer parentheses (optionally in a loop for nested parentheses).

        // Strip wrapping parentheses: ( expr )
        if (
            count($include) >= 3 &&
            $include[0]->value === '(' &&
            $include[count($include) - 1]->value === ')'
        ) {
            $include = array_slice($include, 1, -1);
            $include = array_values($include);
        }

        // Drop whitespace tokens
        $include = array_values(array_filter($include, static function ($token) {
            return $token->type !== 'T_WHITESPACE';
        }));