blitzstrike 1.0.12 → 1.0.13

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
@@ -43,6 +44,7 @@ var __esm = (fn, res, err) => () => {
     throw err[0];
   return res;
 };
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS(function(exports) {
@@ -6930,6 +6932,262 @@ var require_dist = __commonJS(function(exports, module) {
   exports.default = formatsPlugin;
 });
 
+// src/scanner.ts
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function lineno(text, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++) {
+    if (text.charCodeAt(i) === 10)
+      n++;
+  }
+  return n;
+}
+function iterSourceFiles(root, maxFiles = 5000) {
+  const out = [];
+  const walk = (dir) => {
+    if (out.length >= maxFiles)
+      return;
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (out.length >= maxFiles)
+        return;
+      const full = join(dir, name);
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (SKIP_PARTS.has(name) || LIB_PARTS.has(name))
+          continue;
+        walk(full);
+      } else if (st.isFile()) {
+        const dot = name.lastIndexOf(".");
+        const ext = dot >= 0 ? name.slice(dot).toLowerCase() : "";
+        if (!TARGET_EXTS.has(ext))
+          continue;
+        out.push(full);
+      }
+    }
+  };
+  walk(root);
+  return out;
+}
+function findFunctionBounds(text, funcStart) {
+  const brace = text.indexOf("{", funcStart);
+  if (brace === -1)
+    return null;
+  let depth = 0;
+  for (let i = brace;i < text.length; i++) {
+    const c = text[i];
+    if (c === "{")
+      depth++;
+    else if (c === "}") {
+      depth--;
+      if (depth === 0)
+        return [funcStart, i + 1];
+    }
+  }
+  return null;
+}
+function scanFile(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return { file: path, endpoints: [], sinks: [], auth_gates_present: [], error: "unreadable" };
+  }
+  const endpoints = [];
+  for (const hook of NOPRIV_HOOKS) {
+    const re = new RegExp(escapeRegExp(hook), "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      endpoints.push({ hook, line: lineno(text, m.index) });
+    }
+  }
+  const sinks = [];
+  for (const [sink, bugclass] of Object.entries(SINKS)) {
+    const re = new RegExp(escapeRegExp(sink), "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      sinks.push({ sink, class: bugclass, line: lineno(text, m.index) });
+    }
+  }
+  const gates = AUTH_GATES.filter((g) => text.includes(g));
+  const lines = text.split(`
+`).length;
+  return { file: path, lines, endpoints, sinks, auth_gates_present: gates };
+}
+function traceFunction(path, symbol) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return { file: path, symbol, definitions: [], definition_count: 0, error: "unreadable" };
+  }
+  const pattern = new RegExp(`function\\s+&?${escapeRegExp(symbol)}\\s*\\(`, "g");
+  const results = [];
+  let m;
+  while ((m = pattern.exec(text)) !== null) {
+    const bounds = findFunctionBounds(text, m.index);
+    if (!bounds)
+      continue;
+    const [start, end] = bounds;
+    const body = text.slice(start, end);
+    const bodyStartLine = lineno(text, start);
+    const bodyEndLine = lineno(text, end);
+    const innerSinks = [];
+    for (const [sink, bugclass] of Object.entries(SINKS)) {
+      const re = new RegExp(escapeRegExp(sink), "g");
+      let sm;
+      while ((sm = re.exec(body)) !== null) {
+        innerSinks.push({
+          sink,
+          class: bugclass,
+          line: bodyStartLine + body.slice(0, sm.index).split(`
+`).length - 1
+        });
+      }
+    }
+    const innerGates = AUTH_GATES.filter((g) => body.includes(g));
+    results.push({
+      line: bodyStartLine,
+      line_end: bodyEndLine,
+      length: end - start,
+      sinks_in_scope: innerSinks,
+      auth_gates_in_scope: innerGates,
+      body_preview: body.slice(0, 4000)
+    });
+  }
+  return {
+    file: path,
+    symbol,
+    definitions: results,
+    definition_count: results.length
+  };
+}
+function grepInFunctions(root, sink, maxHits = 50) {
+  const hits = [];
+  for (const p of iterSourceFiles(root)) {
+    if (hits.length >= maxHits)
+      break;
+    let text;
+    try {
+      text = readFileSync(p, "utf8");
+    } catch {
+      continue;
+    }
+    const re = new RegExp(escapeRegExp(sink), "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      const line = lineno(text, m.index);
+      const head = text.slice(0, m.index);
+      const funcRe = /function\s+&?\w+\s*\(/g;
+      const funcs = [];
+      let fm;
+      while ((fm = funcRe.exec(head)) !== null)
+        funcs.push(fm);
+      if (funcs.length === 0)
+        continue;
+      const fstart = funcs[funcs.length - 1].index;
+      const bounds = findFunctionBounds(text, fstart);
+      if (!bounds || !(bounds[0] <= m.index && m.index < bounds[1]))
+        continue;
+      const body = text.slice(bounds[0], bounds[1]);
+      const gates = AUTH_GATES.filter((g) => body.includes(g));
+      hits.push({
+        file: p,
+        line,
+        sink,
+        auth_gates_in_scope: gates,
+        guarded: gates.length > 0
+      });
+      if (hits.length >= maxHits)
+        break;
+    }
+  }
+  return hits;
+}
+var NOPRIV_HOOKS, SINKS, AUTH_GATES, TARGET_EXTS, SKIP_PARTS, LIB_PARTS;
+var init_scanner = __esm(() => {
+  NOPRIV_HOOKS = [
+    "wp_ajax_nopriv_",
+    "admin_post_nopriv_",
+    "register_rest_route",
+    "wp_ajax_"
+  ];
+  SINKS = {
+    "eval(": "RCE (code execution)",
+    "assert(": "RCE (code execution, PHP <8)",
+    "system(": "RCE (command execution)",
+    "exec(": "RCE (command execution)",
+    "shell_exec(": "RCE (command execution)",
+    "passthru(": "RCE (command execution)",
+    "proc_open(": "RCE (command execution)",
+    "popen(": "RCE (command execution)",
+    "move_uploaded_file(": "File upload (-> RCE if .php lands in webroot)",
+    "file_put_contents(": "Arbitrary file write (-> RCE via CF-003)",
+    "fwrite(": "Arbitrary file write",
+    "unserialize(": "PHP object injection (POP gadget chain)",
+    "maybe_unserialize(": "PHP object injection (weak)",
+    "include(": "Local file inclusion",
+    "require(": "Local file inclusion",
+    "include_once(": "Local file inclusion",
+    "require_once(": "Local file inclusion",
+    "$wpdb->query(": "SQL injection (unprepared query)",
+    "$wpdb->get_var(": "SQL injection (unprepared query)",
+    "$wpdb->get_results(": "SQL injection (unprepared query)",
+    "->query(": "SQL injection (query builder)",
+    "->whereRaw(": "SQL injection (raw where)",
+    "wp_remote_get(": "SSRF (unvalidated URL fetch)",
+    "wp_remote_post(": "SSRF (unvalidated URL fetch)",
+    "file_get_contents(": "SSRF / file read",
+    "extract(": "Variable injection (-> LFI/RCE without EXTR_SKIP)",
+    "call_user_func(": "Dynamic dispatch (attacker-controlled callback)",
+    "call_user_func_array(": "Dynamic dispatch",
+    "create_function(": "RCE (deprecated eval wrapper)",
+    "preg_replace(": "RCE (if /e modifier or code in pattern)"
+  };
+  AUTH_GATES = [
+    "check_ajax_referer",
+    "check_admin_referer",
+    "wp_verify_nonce",
+    "current_user_can",
+    "is_user_logged_in",
+    "JSession::checkToken",
+    "->authorise(",
+    "->authorize(",
+    "permission_callback"
+  ];
+  TARGET_EXTS = new Set([
+    ".php",
+    ".phtml",
+    ".php5",
+    ".php7",
+    ".inc",
+    ".module",
+    ".install"
+  ]);
+  SKIP_PARTS = new Set(["vendor", "node_modules", ".git", "tests", "test"]);
+  LIB_PARTS = new Set([
+    "lib",
+    "libraries",
+    "third-party",
+    "third_party",
+    "libs"
+  ]);
+});
+
 // src/sync.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync8, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
 import { join as join8 } from "node:path";
@@ -21669,258 +21927,8 @@ class StdioServerTransport {
   }
 }
 
-// src/scanner.ts
-import { readFileSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
-var NOPRIV_HOOKS = [
-  "wp_ajax_nopriv_",
-  "admin_post_nopriv_",
-  "register_rest_route",
-  "wp_ajax_"
-];
-var SINKS = {
-  "eval(": "RCE (code execution)",
-  "assert(": "RCE (code execution, PHP <8)",
-  "system(": "RCE (command execution)",
-  "exec(": "RCE (command execution)",
-  "shell_exec(": "RCE (command execution)",
-  "passthru(": "RCE (command execution)",
-  "proc_open(": "RCE (command execution)",
-  "popen(": "RCE (command execution)",
-  "move_uploaded_file(": "File upload (-> RCE if .php lands in webroot)",
-  "file_put_contents(": "Arbitrary file write (-> RCE via CF-003)",
-  "fwrite(": "Arbitrary file write",
-  "unserialize(": "PHP object injection (POP gadget chain)",
-  "maybe_unserialize(": "PHP object injection (weak)",
-  "include(": "Local file inclusion",
-  "require(": "Local file inclusion",
-  "include_once(": "Local file inclusion",
-  "require_once(": "Local file inclusion",
-  "$wpdb->query(": "SQL injection (unprepared query)",
-  "$wpdb->get_var(": "SQL injection (unprepared query)",
-  "$wpdb->get_results(": "SQL injection (unprepared query)",
-  "->query(": "SQL injection (query builder)",
-  "->whereRaw(": "SQL injection (raw where)",
-  "wp_remote_get(": "SSRF (unvalidated URL fetch)",
-  "wp_remote_post(": "SSRF (unvalidated URL fetch)",
-  "file_get_contents(": "SSRF / file read",
-  "extract(": "Variable injection (-> LFI/RCE without EXTR_SKIP)",
-  "call_user_func(": "Dynamic dispatch (attacker-controlled callback)",
-  "call_user_func_array(": "Dynamic dispatch",
-  "create_function(": "RCE (deprecated eval wrapper)",
-  "preg_replace(": "RCE (if /e modifier or code in pattern)"
-};
-var AUTH_GATES = [
-  "check_ajax_referer",
-  "check_admin_referer",
-  "wp_verify_nonce",
-  "current_user_can",
-  "is_user_logged_in",
-  "JSession::checkToken",
-  "->authorise(",
-  "->authorize(",
-  "permission_callback"
-];
-var TARGET_EXTS = new Set([
-  ".php",
-  ".phtml",
-  ".php5",
-  ".php7",
-  ".inc",
-  ".module",
-  ".install"
-]);
-var SKIP_PARTS = new Set(["vendor", "node_modules", ".git", "tests", "test"]);
-var LIB_PARTS = new Set([
-  "lib",
-  "libraries",
-  "third-party",
-  "third_party",
-  "libs"
-]);
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function lineno(text, pos) {
-  let n = 1;
-  for (let i = 0;i < pos; i++) {
-    if (text.charCodeAt(i) === 10)
-      n++;
-  }
-  return n;
-}
-function iterSourceFiles(root, maxFiles = 5000) {
-  const out = [];
-  const walk = (dir) => {
-    if (out.length >= maxFiles)
-      return;
-    let entries;
-    try {
-      entries = readdirSync(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      if (out.length >= maxFiles)
-        return;
-      const full = join(dir, name);
-      let st;
-      try {
-        st = statSync(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_PARTS.has(name) || LIB_PARTS.has(name))
-          continue;
-        walk(full);
-      } else if (st.isFile()) {
-        const dot = name.lastIndexOf(".");
-        const ext = dot >= 0 ? name.slice(dot).toLowerCase() : "";
-        if (!TARGET_EXTS.has(ext))
-          continue;
-        out.push(full);
-      }
-    }
-  };
-  walk(root);
-  return out;
-}
-function findFunctionBounds(text, funcStart) {
-  const brace = text.indexOf("{", funcStart);
-  if (brace === -1)
-    return null;
-  let depth = 0;
-  for (let i = brace;i < text.length; i++) {
-    const c = text[i];
-    if (c === "{")
-      depth++;
-    else if (c === "}") {
-      depth--;
-      if (depth === 0)
-        return [funcStart, i + 1];
-    }
-  }
-  return null;
-}
-function scanFile(path) {
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch {
-    return { file: path, endpoints: [], sinks: [], auth_gates_present: [], error: "unreadable" };
-  }
-  const endpoints = [];
-  for (const hook of NOPRIV_HOOKS) {
-    const re = new RegExp(escapeRegExp(hook), "g");
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      endpoints.push({ hook, line: lineno(text, m.index) });
-    }
-  }
-  const sinks = [];
-  for (const [sink, bugclass] of Object.entries(SINKS)) {
-    const re = new RegExp(escapeRegExp(sink), "g");
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      sinks.push({ sink, class: bugclass, line: lineno(text, m.index) });
-    }
-  }
-  const gates = AUTH_GATES.filter((g) => text.includes(g));
-  const lines = text.split(`
-`).length;
-  return { file: path, lines, endpoints, sinks, auth_gates_present: gates };
-}
-function traceFunction(path, symbol) {
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch {
-    return { file: path, symbol, definitions: [], definition_count: 0, error: "unreadable" };
-  }
-  const pattern = new RegExp(`function\\s+&?${escapeRegExp(symbol)}\\s*\\(`, "g");
-  const results = [];
-  let m;
-  while ((m = pattern.exec(text)) !== null) {
-    const bounds = findFunctionBounds(text, m.index);
-    if (!bounds)
-      continue;
-    const [start, end] = bounds;
-    const body = text.slice(start, end);
-    const bodyStartLine = lineno(text, start);
-    const bodyEndLine = lineno(text, end);
-    const innerSinks = [];
-    for (const [sink, bugclass] of Object.entries(SINKS)) {
-      const re = new RegExp(escapeRegExp(sink), "g");
-      let sm;
-      while ((sm = re.exec(body)) !== null) {
-        innerSinks.push({
-          sink,
-          class: bugclass,
-          line: bodyStartLine + body.slice(0, sm.index).split(`
-`).length - 1
-        });
-      }
-    }
-    const innerGates = AUTH_GATES.filter((g) => body.includes(g));
-    results.push({
-      line: bodyStartLine,
-      line_end: bodyEndLine,
-      length: end - start,
-      sinks_in_scope: innerSinks,
-      auth_gates_in_scope: innerGates,
-      body_preview: body.slice(0, 4000)
-    });
-  }
-  return {
-    file: path,
-    symbol,
-    definitions: results,
-    definition_count: results.length
-  };
-}
-function grepInFunctions(root, sink, maxHits = 50) {
-  const hits = [];
-  for (const p of iterSourceFiles(root)) {
-    if (hits.length >= maxHits)
-      break;
-    let text;
-    try {
-      text = readFileSync(p, "utf8");
-    } catch {
-      continue;
-    }
-    const re = new RegExp(escapeRegExp(sink), "g");
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      const line = lineno(text, m.index);
-      const head = text.slice(0, m.index);
-      const funcRe = /function\s+&?\w+\s*\(/g;
-      const funcs = [];
-      let fm;
-      while ((fm = funcRe.exec(head)) !== null)
-        funcs.push(fm);
-      if (funcs.length === 0)
-        continue;
-      const fstart = funcs[funcs.length - 1].index;
-      const bounds = findFunctionBounds(text, fstart);
-      if (!bounds || !(bounds[0] <= m.index && m.index < bounds[1]))
-        continue;
-      const body = text.slice(bounds[0], bounds[1]);
-      const gates = AUTH_GATES.filter((g) => body.includes(g));
-      hits.push({
-        file: p,
-        line,
-        sink,
-        auth_gates_in_scope: gates,
-        guarded: gates.length > 0
-      });
-      if (hits.length >= maxHits)
-        break;
-    }
-  }
-  return hits;
-}
+// src/server.ts
+init_scanner();
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -22002,6 +22010,7 @@ async function nvdLookup(cveId) {
 }
 
 // src/orchestrator.ts
+init_scanner();
 import { readFileSync as readFileSync4, existsSync as existsSync3, statSync as statSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -22294,7 +22303,7 @@ var LIFECYCLE_TRANSITIONS = {
   detected: ["triaged", "rejected"],
   triaged: ["hypothesis", "rejected", "out_of_scope"],
   hypothesis: ["validating", "false_positive", "rejected", "blocked"],
-  validating: ["confirmed", "likely", "unconfirmed", "false_positive", "blocked", "out_of_scope"],
+  validating: ["confirmed", "false_positive", "blocked", "out_of_scope"],
   confirmed: [],
   false_positive: [],
   rejected: [],
@@ -23146,6 +23155,151 @@ async function activeScan(target, scope = "", mode = "bug-bounty", allowed = und
   return result;
 }
 
+// src/dataflow.ts
+init_scanner();
+var SOURCES = {
+  $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
+  $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
+  $_REQUEST: { id: "http_request", label: "HTTP request (merged)", attacker_controlled: true },
+  $_COOKIE: { id: "http_cookie", label: "HTTP cookie", attacker_controlled: true },
+  $_FILES: { id: "uploaded_file", label: "Uploaded file", attacker_controlled: true },
+  $_SERVER: { id: "http_header", label: "HTTP header / server env", attacker_controlled: true },
+  "file_get_contents('php://input')": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
+  "php://input": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
+  json_decode: { id: "json_input", label: "JSON input", attacker_controlled: true },
+  getallheaders: { id: "http_header", label: "HTTP header", attacker_controlled: true },
+  $argv: { id: "cli_argument", label: "CLI argument", attacker_controlled: false },
+  getenv: { id: "environment_variable", label: "Environment variable", attacker_controlled: false },
+  "$wpdb->get_results": { id: "database_value", label: "Database value", attacker_controlled: false },
+  wp_remote_get: { id: "external_api", label: "External API data", attacker_controlled: false }
+};
+function classifySource(line) {
+  for (const [token, cls] of Object.entries(SOURCES)) {
+    if (line.includes(token))
+      return cls;
+  }
+  return null;
+}
+var SINK_CLASS_MAP = [
+  [/->query\(|\$wpdb->query|\$wpdb->get_var|\$wpdb->get_results|->whereRaw|->selectRaw/, { id: "sql_execution", category: "SQL execution", cwe: "CWE-89" }],
+  [/eval\(|assert\(|create_function\(|call_user_func\(|preg_replace\(/, { id: "code_execution", category: "Dynamic evaluation / code execution", cwe: "CWE-94" }],
+  [/system\(|exec\(|shell_exec\(|passthru\(|proc_open\(|popen\(/, { id: "command_execution", category: "Command execution", cwe: "CWE-78" }],
+  [/move_uploaded_file\(|file_put_contents\(|fwrite\(|fopen\(|unlink\(/, { id: "file_operations", category: "File operations", cwe: "CWE-434" }],
+  [/include\(|require\(|include_once\(|require_once\(/, { id: "file_inclusion", category: "File inclusion", cwe: "CWE-98" }],
+  [/unserialize\(|maybe_unserialize\(/, { id: "deserialization", category: "Deserialization", cwe: "CWE-502" }],
+  [/wp_remote_get\(|wp_remote_post\(|file_get_contents\(|curl_exec\(/, { id: "http_request", category: "HTTP request (SSRF)", cwe: "CWE-918" }],
+  [/header\(|wp_redirect\(|wp_safe_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
+  [/echo\s|print\s|printf\(/, { id: "html_render", category: "HTML rendering (XSS)", cwe: "CWE-79" }],
+  [/simplexml_load_string\(|new SimpleXMLElement|DOMDocument/, { id: "xml_processing", category: "XML processing (XXE)", cwe: "CWE-611" }],
+  [/ZipArchive|PharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }]
+];
+function classifySink2(sink) {
+  for (const [re, cls] of SINK_CLASS_MAP) {
+    if (re.test(sink))
+      return cls;
+  }
+  return null;
+}
+var SANITIZERS = {
+  htmlspecialchars: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
+  esc_html: { id: "html_escape", label: "HTML escape", neutralizes: ["html_render"] },
+  esc_attr: { id: "html_escape", label: "HTML attribute escape", neutralizes: ["html_render"] },
+  htmlentities: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
+  esc_sql: { id: "sql_escape", label: "SQL escape", neutralizes: ["sql_execution"] },
+  "$wpdb->prepare": { id: "sql_prepare", label: "Prepared SQL statement", neutralizes: ["sql_execution"] },
+  "->prepare(": { id: "sql_prepare", label: "Prepared statement", neutralizes: ["sql_execution"] },
+  filter_var: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
+  filter_input: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
+  sanitize_text_field: { id: "wp_sanitize", label: "WordPress sanitize", neutralizes: ["html_render"] },
+  sanitize_file_name: { id: "wp_sanitize_file", label: "File-name sanitize", neutralizes: ["file_operations", "file_inclusion"] },
+  wp_verify_nonce: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
+  check_ajax_referer: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
+  escapeshellarg: { id: "shell_escape", label: "Shell argument escape", neutralizes: ["command_execution"] },
+  escapeshellcmd: { id: "shell_escape", label: "Shell command escape", neutralizes: ["command_execution"] },
+  intval: { id: "int_cast", label: "Integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
+  absint: { id: "int_cast", label: "Absolute integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
+  "preg_replace.*FILTER": { id: "regex_filter", label: "Regex filter", neutralizes: ["html_render"] }
+};
+function findSanitizers(line) {
+  const out = [];
+  for (const [token, san] of Object.entries(SANITIZERS)) {
+    if (line.includes(token))
+      out.push(san);
+  }
+  return out;
+}
+function isSanitized(sanitizers, sinkCategory) {
+  return sanitizers.some((s) => s.neutralizes.includes(sinkCategory) || s.neutralizes.includes("authorization"));
+}
+function traceDataFlow(path) {
+  const scan = scanFile(path);
+  const result = { file: path, candidates: [], sanitized: [], authorized: [] };
+  if (scan.error)
+    return result;
+  let text;
+  try {
+    const { readFileSync } = __require("node:fs");
+    text = readFileSync(path, "utf8");
+  } catch {
+    return result;
+  }
+  const lines = text.split(`
+`);
+  for (const s of scan.sinks) {
+    const sinkClass = classifySink2(s.sink);
+    if (!sinkClass)
+      continue;
+    const start = Math.max(0, s.line - 15);
+    const window = lines.slice(start, s.line).join(`
+`);
+    const source = classifySource(window);
+    const sanitizers = findSanitizers(window);
+    const authGates = AUTH_GATES.filter((g) => window.includes(g));
+    const edge = {
+      source,
+      sanitizers,
+      auth_gates: authGates,
+      sink: sinkClass,
+      sink_line: s.line,
+      sink_token: s.sink
+    };
+    if (authGates.length > 0) {
+      result.authorized.push(edge);
+      continue;
+    }
+    if (isSanitized(sanitizers, sinkClass.category)) {
+      result.sanitized.push(edge);
+      continue;
+    }
+    result.candidates.push(edge);
+  }
+  return result;
+}
+function groupVariants(results) {
+  const groups = new Map;
+  for (const r of results) {
+    for (const c of r.candidates) {
+      const sig = `${c.sink?.category ?? "?"}|${c.source?.id ?? "unknown"}`;
+      const g = groups.get(sig);
+      if (g) {
+        g.occurrences += 1;
+        if (!g.files.includes(r.file))
+          g.files.push(r.file);
+      } else {
+        groups.set(sig, {
+          signature: sig,
+          root_cause: `unsanitized ${c.source?.label ?? "unknown"} reaching ${c.sink?.category ?? "sink"}`,
+          sink_category: c.sink?.category ?? "?",
+          cwe: c.sink?.cwe,
+          occurrences: 1,
+          files: [r.file]
+        });
+      }
+    }
+  }
+  return [...groups.values()].sort((a, b) => b.occurrences - a.occurrences);
+}
+
 // src/server.ts
 function createServer() {
   const server = new McpServer({
@@ -23665,6 +23819,35 @@ function createServer() {
   }, async ({ text }) => {
     return { content: [{ type: "text", text: JSON.stringify({ redacted: redactSecrets(text) }) }] };
   });
+  server.registerTool("trace_data_flow", {
+    title: "Trace source-to-sink data flow",
+    description: "EAGLE-EYE: trace data flow in a file — classify sources, sinks, sanitizers, and authorization gates. Returns candidates (reachable+unsanitized), sanitized (not findings), and authorized (lower priority).",
+    inputSchema: { path: string2().describe("Source file path") }
+  }, async ({ path }) => {
+    const r = traceDataFlow(path);
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
+  });
+  server.registerTool("variant_analysis", {
+    title: "Group findings by root cause",
+    description: "EAGLE-EYE: variant analysis — group data-flow candidates by root cause (sink category + source), deduplicating identical patterns across files.",
+    inputSchema: { path: string2().describe("Source directory path") }
+  }, async ({ path }) => {
+    await Promise.resolve().then(() => init_scanner());
+    const files = iterSourceFiles(path, 5000);
+    const results = files.map((f) => traceDataFlow(f));
+    const groups = groupVariants(results);
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          files_analyzed: files.length,
+          total_candidates: results.reduce((n, r) => n + r.candidates.length, 0),
+          variant_groups: groups.length,
+          groups
+        })
+      }]
+    };
+  });
   return server;
 }
 async function serve() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {