blitzstrike 1.0.12 → 1.0.14

package/dist/index.js

@@ -6930,8 +6930,269 @@ var require_dist = __commonJS(function(exports, module) {
   exports.default = formatsPlugin;
 });
 
+// src/scanner.ts
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function lineno(text, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++) {
+    if (text.charCodeAt(i) === 10)
+      n++;
+  }
+  return n;
+}
+function iterSourceFiles(root, maxFiles = 5000) {
+  const out = [];
+  const walk = (dir) => {
+    if (out.length >= maxFiles)
+      return;
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (out.length >= maxFiles)
+        return;
+      const full = join(dir, name);
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (SKIP_PARTS.has(name) || LIB_PARTS.has(name))
+          continue;
+        walk(full);
+      } else if (st.isFile()) {
+        const dot = name.lastIndexOf(".");
+        const ext = dot >= 0 ? name.slice(dot).toLowerCase() : "";
+        if (!TARGET_EXTS.has(ext))
+          continue;
+        out.push(full);
+      }
+    }
+  };
+  walk(root);
+  return out;
+}
+function findFunctionBounds(text, funcStart) {
+  const brace = text.indexOf("{", funcStart);
+  if (brace === -1)
+    return null;
+  let depth = 0;
+  for (let i = brace;i < text.length; i++) {
+    const c = text[i];
+    if (c === "{")
+      depth++;
+    else if (c === "}") {
+      depth--;
+      if (depth === 0)
+        return [funcStart, i + 1];
+    }
+  }
+  return null;
+}
+function scanFile(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return { file: path, endpoints: [], sinks: [], auth_gates_present: [], error: "unreadable" };
+  }
+  const endpoints = [];
+  for (const hook of NOPRIV_HOOKS) {
+    const re = new RegExp(escapeRegExp(hook), "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      endpoints.push({ hook, line: lineno(text, m.index) });
+    }
+  }
+  const sinks = [];
+  for (const [sink, bugclass] of Object.entries(SINKS)) {
+    const re = new RegExp(escapeRegExp(sink), "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      sinks.push({ sink, class: bugclass, line: lineno(text, m.index) });
+    }
+  }
+  const gates = AUTH_GATES.filter((g) => text.includes(g));
+  const lines = text.split(`
+`).length;
+  return { file: path, lines, endpoints, sinks, auth_gates_present: gates };
+}
+function traceFunction(path, symbol) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return { file: path, symbol, definitions: [], definition_count: 0, error: "unreadable" };
+  }
+  const pattern = new RegExp(`function\\s+&?${escapeRegExp(symbol)}\\s*\\(`, "g");
+  const results = [];
+  let m;
+  while ((m = pattern.exec(text)) !== null) {
+    const bounds = findFunctionBounds(text, m.index);
+    if (!bounds)
+      continue;
+    const [start, end] = bounds;
+    const body = text.slice(start, end);
+    const bodyStartLine = lineno(text, start);
+    const bodyEndLine = lineno(text, end);
+    const innerSinks = [];
+    for (const [sink, bugclass] of Object.entries(SINKS)) {
+      const re = new RegExp(escapeRegExp(sink), "g");
+      let sm;
+      while ((sm = re.exec(body)) !== null) {
+        innerSinks.push({
+          sink,
+          class: bugclass,
+          line: bodyStartLine + body.slice(0, sm.index).split(`
+`).length - 1
+        });
+      }
+    }
+    const innerGates = AUTH_GATES.filter((g) => body.includes(g));
+    results.push({
+      line: bodyStartLine,
+      line_end: bodyEndLine,
+      length: end - start,
+      sinks_in_scope: innerSinks,
+      auth_gates_in_scope: innerGates,
+      body_preview: body.slice(0, 4000)
+    });
+  }
+  return {
+    file: path,
+    symbol,
+    definitions: results,
+    definition_count: results.length
+  };
+}
+function grepInFunctions(root, sink, maxHits = 50) {
+  const hits = [];
+  for (const p of iterSourceFiles(root)) {
+    if (hits.length >= maxHits)
+      break;
+    let text;
+    try {
+      text = readFileSync(p, "utf8");
+    } catch {
+      continue;
+    }
+    const re = new RegExp(escapeRegExp(sink), "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      const line = lineno(text, m.index);
+      const head = text.slice(0, m.index);
+      const funcRe = /function\s+&?\w+\s*\(/g;
+      const funcs = [];
+      let fm;
+      while ((fm = funcRe.exec(head)) !== null)
+        funcs.push(fm);
+      if (funcs.length === 0)
+        continue;
+      const fstart = funcs[funcs.length - 1].index;
+      const bounds = findFunctionBounds(text, fstart);
+      if (!bounds || !(bounds[0] <= m.index && m.index < bounds[1]))
+        continue;
+      const body = text.slice(bounds[0], bounds[1]);
+      const gates = AUTH_GATES.filter((g) => body.includes(g));
+      hits.push({
+        file: p,
+        line,
+        sink,
+        auth_gates_in_scope: gates,
+        guarded: gates.length > 0
+      });
+      if (hits.length >= maxHits)
+        break;
+    }
+  }
+  return hits;
+}
+var NOPRIV_HOOKS, SINKS, AUTH_GATES, TARGET_EXTS, SKIP_PARTS, LIB_PARTS;
+var init_scanner = __esm(() => {
+  NOPRIV_HOOKS = [
+    "wp_ajax_nopriv_",
+    "admin_post_nopriv_",
+    "register_rest_route",
+    "wp_ajax_"
+  ];
+  SINKS = {
+    "eval(": "RCE (code execution)",
+    "assert(": "RCE (code execution, PHP <8)",
+    "system(": "RCE (command execution)",
+    "exec(": "RCE (command execution)",
+    "shell_exec(": "RCE (command execution)",
+    "passthru(": "RCE (command execution)",
+    "proc_open(": "RCE (command execution)",
+    "popen(": "RCE (command execution)",
+    "move_uploaded_file(": "File upload (-> RCE if .php lands in webroot)",
+    "file_put_contents(": "Arbitrary file write (-> RCE via CF-003)",
+    "fwrite(": "Arbitrary file write",
+    "unserialize(": "PHP object injection (POP gadget chain)",
+    "maybe_unserialize(": "PHP object injection (weak)",
+    "include(": "Local file inclusion",
+    "require(": "Local file inclusion",
+    "include_once(": "Local file inclusion",
+    "require_once(": "Local file inclusion",
+    "$wpdb->query(": "SQL injection (unprepared query)",
+    "$wpdb->get_var(": "SQL injection (unprepared query)",
+    "$wpdb->get_results(": "SQL injection (unprepared query)",
+    "->query(": "SQL injection (query builder)",
+    "->whereRaw(": "SQL injection (raw where)",
+    "wp_remote_get(": "SSRF (unvalidated URL fetch)",
+    "wp_remote_post(": "SSRF (unvalidated URL fetch)",
+    "file_get_contents(": "SSRF / file read",
+    "extract(": "Variable injection (-> LFI/RCE without EXTR_SKIP)",
+    "call_user_func(": "Dynamic dispatch (attacker-controlled callback)",
+    "call_user_func_array(": "Dynamic dispatch",
+    "create_function(": "RCE (deprecated eval wrapper)",
+    "preg_replace(": "RCE (if /e modifier or code in pattern)",
+    "echo ": "XSS (reflected output)",
+    "print ": "XSS (reflected output)",
+    "printf(": "XSS (reflected output)",
+    "header(": "Open redirect / header injection",
+    "wp_redirect(": "Open redirect"
+  };
+  AUTH_GATES = [
+    "check_ajax_referer",
+    "check_admin_referer",
+    "wp_verify_nonce",
+    "current_user_can",
+    "is_user_logged_in",
+    "JSession::checkToken",
+    "->authorise(",
+    "->authorize(",
+    "permission_callback"
+  ];
+  TARGET_EXTS = new Set([
+    ".php",
+    ".phtml",
+    ".php5",
+    ".php7",
+    ".inc",
+    ".module",
+    ".install"
+  ]);
+  SKIP_PARTS = new Set(["vendor", "node_modules", ".git", "tests", "test"]);
+  LIB_PARTS = new Set([
+    "lib",
+    "libraries",
+    "third-party",
+    "third_party",
+    "libs"
+  ]);
+});
+
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync8, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
 import { join as join8 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
@@ -7027,7 +7288,7 @@ function manualCopy(src, dst) {
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync2(d, readFileSync8(s));
+      writeFileSync2(d, readFileSync9(s));
   }
 }
 var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
@@ -21669,258 +21930,8 @@ class StdioServerTransport {
   }
 }
 
-// src/scanner.ts
-import { readFileSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
-var NOPRIV_HOOKS = [
-  "wp_ajax_nopriv_",
-  "admin_post_nopriv_",
-  "register_rest_route",
-  "wp_ajax_"
-];
-var SINKS = {
-  "eval(": "RCE (code execution)",
-  "assert(": "RCE (code execution, PHP <8)",
-  "system(": "RCE (command execution)",
-  "exec(": "RCE (command execution)",
-  "shell_exec(": "RCE (command execution)",
-  "passthru(": "RCE (command execution)",
-  "proc_open(": "RCE (command execution)",
-  "popen(": "RCE (command execution)",
-  "move_uploaded_file(": "File upload (-> RCE if .php lands in webroot)",
-  "file_put_contents(": "Arbitrary file write (-> RCE via CF-003)",
-  "fwrite(": "Arbitrary file write",
-  "unserialize(": "PHP object injection (POP gadget chain)",
-  "maybe_unserialize(": "PHP object injection (weak)",
-  "include(": "Local file inclusion",
-  "require(": "Local file inclusion",
-  "include_once(": "Local file inclusion",
-  "require_once(": "Local file inclusion",
-  "$wpdb->query(": "SQL injection (unprepared query)",
-  "$wpdb->get_var(": "SQL injection (unprepared query)",
-  "$wpdb->get_results(": "SQL injection (unprepared query)",
-  "->query(": "SQL injection (query builder)",
-  "->whereRaw(": "SQL injection (raw where)",
-  "wp_remote_get(": "SSRF (unvalidated URL fetch)",
-  "wp_remote_post(": "SSRF (unvalidated URL fetch)",
-  "file_get_contents(": "SSRF / file read",
-  "extract(": "Variable injection (-> LFI/RCE without EXTR_SKIP)",
-  "call_user_func(": "Dynamic dispatch (attacker-controlled callback)",
-  "call_user_func_array(": "Dynamic dispatch",
-  "create_function(": "RCE (deprecated eval wrapper)",
-  "preg_replace(": "RCE (if /e modifier or code in pattern)"
-};
-var AUTH_GATES = [
-  "check_ajax_referer",
-  "check_admin_referer",
-  "wp_verify_nonce",
-  "current_user_can",
-  "is_user_logged_in",
-  "JSession::checkToken",
-  "->authorise(",
-  "->authorize(",
-  "permission_callback"
-];
-var TARGET_EXTS = new Set([
-  ".php",
-  ".phtml",
-  ".php5",
-  ".php7",
-  ".inc",
-  ".module",
-  ".install"
-]);
-var SKIP_PARTS = new Set(["vendor", "node_modules", ".git", "tests", "test"]);
-var LIB_PARTS = new Set([
-  "lib",
-  "libraries",
-  "third-party",
-  "third_party",
-  "libs"
-]);
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function lineno(text, pos) {
-  let n = 1;
-  for (let i = 0;i < pos; i++) {
-    if (text.charCodeAt(i) === 10)
-      n++;
-  }
-  return n;
-}
-function iterSourceFiles(root, maxFiles = 5000) {
-  const out = [];
-  const walk = (dir) => {
-    if (out.length >= maxFiles)
-      return;
-    let entries;
-    try {
-      entries = readdirSync(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      if (out.length >= maxFiles)
-        return;
-      const full = join(dir, name);
-      let st;
-      try {
-        st = statSync(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_PARTS.has(name) || LIB_PARTS.has(name))
-          continue;
-        walk(full);
-      } else if (st.isFile()) {
-        const dot = name.lastIndexOf(".");
-        const ext = dot >= 0 ? name.slice(dot).toLowerCase() : "";
-        if (!TARGET_EXTS.has(ext))
-          continue;
-        out.push(full);
-      }
-    }
-  };
-  walk(root);
-  return out;
-}
-function findFunctionBounds(text, funcStart) {
-  const brace = text.indexOf("{", funcStart);
-  if (brace === -1)
-    return null;
-  let depth = 0;
-  for (let i = brace;i < text.length; i++) {
-    const c = text[i];
-    if (c === "{")
-      depth++;
-    else if (c === "}") {
-      depth--;
-      if (depth === 0)
-        return [funcStart, i + 1];
-    }
-  }
-  return null;
-}
-function scanFile(path) {
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch {
-    return { file: path, endpoints: [], sinks: [], auth_gates_present: [], error: "unreadable" };
-  }
-  const endpoints = [];
-  for (const hook of NOPRIV_HOOKS) {
-    const re = new RegExp(escapeRegExp(hook), "g");
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      endpoints.push({ hook, line: lineno(text, m.index) });
-    }
-  }
-  const sinks = [];
-  for (const [sink, bugclass] of Object.entries(SINKS)) {
-    const re = new RegExp(escapeRegExp(sink), "g");
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      sinks.push({ sink, class: bugclass, line: lineno(text, m.index) });
-    }
-  }
-  const gates = AUTH_GATES.filter((g) => text.includes(g));
-  const lines = text.split(`
-`).length;
-  return { file: path, lines, endpoints, sinks, auth_gates_present: gates };
-}
-function traceFunction(path, symbol) {
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch {
-    return { file: path, symbol, definitions: [], definition_count: 0, error: "unreadable" };
-  }
-  const pattern = new RegExp(`function\\s+&?${escapeRegExp(symbol)}\\s*\\(`, "g");
-  const results = [];
-  let m;
-  while ((m = pattern.exec(text)) !== null) {
-    const bounds = findFunctionBounds(text, m.index);
-    if (!bounds)
-      continue;
-    const [start, end] = bounds;
-    const body = text.slice(start, end);
-    const bodyStartLine = lineno(text, start);
-    const bodyEndLine = lineno(text, end);
-    const innerSinks = [];
-    for (const [sink, bugclass] of Object.entries(SINKS)) {
-      const re = new RegExp(escapeRegExp(sink), "g");
-      let sm;
-      while ((sm = re.exec(body)) !== null) {
-        innerSinks.push({
-          sink,
-          class: bugclass,
-          line: bodyStartLine + body.slice(0, sm.index).split(`
-`).length - 1
-        });
-      }
-    }
-    const innerGates = AUTH_GATES.filter((g) => body.includes(g));
-    results.push({
-      line: bodyStartLine,
-      line_end: bodyEndLine,
-      length: end - start,
-      sinks_in_scope: innerSinks,
-      auth_gates_in_scope: innerGates,
-      body_preview: body.slice(0, 4000)
-    });
-  }
-  return {
-    file: path,
-    symbol,
-    definitions: results,
-    definition_count: results.length
-  };
-}
-function grepInFunctions(root, sink, maxHits = 50) {
-  const hits = [];
-  for (const p of iterSourceFiles(root)) {
-    if (hits.length >= maxHits)
-      break;
-    let text;
-    try {
-      text = readFileSync(p, "utf8");
-    } catch {
-      continue;
-    }
-    const re = new RegExp(escapeRegExp(sink), "g");
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      const line = lineno(text, m.index);
-      const head = text.slice(0, m.index);
-      const funcRe = /function\s+&?\w+\s*\(/g;
-      const funcs = [];
-      let fm;
-      while ((fm = funcRe.exec(head)) !== null)
-        funcs.push(fm);
-      if (funcs.length === 0)
-        continue;
-      const fstart = funcs[funcs.length - 1].index;
-      const bounds = findFunctionBounds(text, fstart);
-      if (!bounds || !(bounds[0] <= m.index && m.index < bounds[1]))
-        continue;
-      const body = text.slice(bounds[0], bounds[1]);
-      const gates = AUTH_GATES.filter((g) => body.includes(g));
-      hits.push({
-        file: p,
-        line,
-        sink,
-        auth_gates_in_scope: gates,
-        guarded: gates.length > 0
-      });
-      if (hits.length >= maxHits)
-        break;
-    }
-  }
-  return hits;
-}
+// src/server.ts
+init_scanner();
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -22002,6 +22013,7 @@ async function nvdLookup(cveId) {
 }
 
 // src/orchestrator.ts
+init_scanner();
 import { readFileSync as readFileSync4, existsSync as existsSync3, statSync as statSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -22294,7 +22306,7 @@ var LIFECYCLE_TRANSITIONS = {
   detected: ["triaged", "rejected"],
   triaged: ["hypothesis", "rejected", "out_of_scope"],
   hypothesis: ["validating", "false_positive", "rejected", "blocked"],
-  validating: ["confirmed", "likely", "unconfirmed", "false_positive", "blocked", "out_of_scope"],
+  validating: ["confirmed", "false_positive", "blocked", "out_of_scope"],
   confirmed: [],
   false_positive: [],
   rejected: [],
@@ -23146,6 +23158,166 @@ async function activeScan(target, scope = "", mode = "bug-bounty", allowed = und
   return result;
 }
 
+// src/dataflow.ts
+init_scanner();
+import { readFileSync as readFileSync7 } from "node:fs";
+var SOURCES = {
+  $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
+  $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
+  $_REQUEST: { id: "http_request", label: "HTTP request (merged)", attacker_controlled: true },
+  $_COOKIE: { id: "http_cookie", label: "HTTP cookie", attacker_controlled: true },
+  $_FILES: { id: "uploaded_file", label: "Uploaded file", attacker_controlled: true },
+  $_SERVER: { id: "http_header", label: "HTTP header / server env", attacker_controlled: true },
+  "file_get_contents('php://input')": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
+  "php://input": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
+  json_decode: { id: "json_input", label: "JSON input", attacker_controlled: true },
+  getallheaders: { id: "http_header", label: "HTTP header", attacker_controlled: true },
+  $argv: { id: "cli_argument", label: "CLI argument", attacker_controlled: false },
+  getenv: { id: "environment_variable", label: "Environment variable", attacker_controlled: false },
+  "$wpdb->get_results": { id: "database_value", label: "Database value", attacker_controlled: false },
+  wp_remote_get: { id: "external_api", label: "External API data", attacker_controlled: false }
+};
+function classifySource(line) {
+  for (const [token, cls] of Object.entries(SOURCES)) {
+    if (line.includes(token))
+      return cls;
+  }
+  return null;
+}
+var SINK_CLASS_MAP = [
+  [/->query\(|\$wpdb->query|\$wpdb->get_var|\$wpdb->get_results|->whereRaw|->selectRaw/, { id: "sql_execution", category: "SQL execution", cwe: "CWE-89" }],
+  [/eval\(|assert\(|create_function\(|call_user_func\(|preg_replace\(/, { id: "code_execution", category: "Dynamic evaluation / code execution", cwe: "CWE-94" }],
+  [/system\(|exec\(|shell_exec\(|passthru\(|proc_open\(|popen\(/, { id: "command_execution", category: "Command execution", cwe: "CWE-78" }],
+  [/move_uploaded_file\(|file_put_contents\(|fwrite\(|fopen\(|unlink\(/, { id: "file_operations", category: "File operations", cwe: "CWE-434" }],
+  [/include\(|require\(|include_once\(|require_once\(/, { id: "file_inclusion", category: "File inclusion", cwe: "CWE-98" }],
+  [/unserialize\(|maybe_unserialize\(/, { id: "deserialization", category: "Deserialization", cwe: "CWE-502" }],
+  [/wp_remote_get\(|wp_remote_post\(|file_get_contents\(|curl_exec\(/, { id: "http_request", category: "HTTP request (SSRF)", cwe: "CWE-918" }],
+  [/header\(|wp_redirect\(|wp_safe_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
+  [/echo\s|print\s|printf\(/, { id: "html_render", category: "HTML rendering (XSS)", cwe: "CWE-79" }],
+  [/simplexml_load_string\(|new SimpleXMLElement|DOMDocument/, { id: "xml_processing", category: "XML processing (XXE)", cwe: "CWE-611" }],
+  [/ZipArchive|PharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }]
+];
+function classifySink2(sink) {
+  for (const [re, cls] of SINK_CLASS_MAP) {
+    if (re.test(sink))
+      return cls;
+  }
+  return null;
+}
+var SANITIZERS = {
+  htmlspecialchars: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
+  esc_html: { id: "html_escape", label: "HTML escape", neutralizes: ["html_render"] },
+  esc_attr: { id: "html_escape", label: "HTML attribute escape", neutralizes: ["html_render"] },
+  htmlentities: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
+  esc_sql: { id: "sql_escape", label: "SQL escape", neutralizes: ["sql_execution"] },
+  "$wpdb->prepare": { id: "sql_prepare", label: "Prepared SQL statement", neutralizes: ["sql_execution"] },
+  "->prepare(": { id: "sql_prepare", label: "Prepared statement", neutralizes: ["sql_execution"] },
+  filter_var: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
+  filter_input: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
+  sanitize_text_field: { id: "wp_sanitize", label: "WordPress sanitize", neutralizes: ["html_render"] },
+  sanitize_file_name: { id: "wp_sanitize_file", label: "File-name sanitize", neutralizes: ["file_operations", "file_inclusion"] },
+  wp_verify_nonce: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
+  check_ajax_referer: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
+  escapeshellarg: { id: "shell_escape", label: "Shell argument escape", neutralizes: ["command_execution"] },
+  escapeshellcmd: { id: "shell_escape", label: "Shell command escape", neutralizes: ["command_execution"] },
+  intval: { id: "int_cast", label: "Integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
+  absint: { id: "int_cast", label: "Absolute integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
+  "preg_replace.*FILTER": { id: "regex_filter", label: "Regex filter", neutralizes: ["html_render"] }
+};
+function findSanitizers(line) {
+  const out = [];
+  for (const [token, san] of Object.entries(SANITIZERS)) {
+    if (line.includes(token))
+      out.push(san);
+  }
+  return out;
+}
+function isSanitized(sanitizers, sinkCategory) {
+  return sanitizers.some((s) => s.neutralizes.includes(sinkCategory) || s.neutralizes.includes("authorization"));
+}
+function traceDataFlow(path) {
+  const scan = scanFile(path);
+  const result = { file: path, candidates: [], sanitized: [], authorized: [] };
+  if (scan.error)
+    return result;
+  let text;
+  try {
+    text = readFileSync7(path, "utf8");
+  } catch {
+    return result;
+  }
+  const lines = text.split(`
+`);
+  const seen = new Set;
+  const sinks = scan.sinks.filter((s) => {
+    const cls = classifySink2(s.sink);
+    if (!cls)
+      return false;
+    const key = `${cls.id}|${s.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+  for (const s of sinks) {
+    const sinkClass = classifySink2(s.sink);
+    const wideStart = Math.max(0, s.line - 15);
+    const wideWindow = lines.slice(wideStart, s.line).join(`
+`);
+    const sanitizerWindow = lines.slice(Math.max(0, s.line - 3), s.line + 1).join(`
+`);
+    const sinkLine = lines[s.line - 1] ?? "";
+    const prevLine = lines[s.line - 2] ?? "";
+    const authContext = sinkLine + `
+` + prevLine;
+    const source = classifySource(wideWindow);
+    const sanitizers = findSanitizers(sanitizerWindow);
+    const authGates = AUTH_GATES.filter((g) => authContext.includes(g));
+    const edge = {
+      source,
+      sanitizers,
+      auth_gates: authGates,
+      sink: sinkClass,
+      sink_line: s.line,
+      sink_token: s.sink
+    };
+    if (authGates.length > 0) {
+      result.authorized.push(edge);
+      continue;
+    }
+    if (isSanitized(sanitizers, sinkClass.id)) {
+      result.sanitized.push(edge);
+      continue;
+    }
+    result.candidates.push(edge);
+  }
+  return result;
+}
+function groupVariants(results) {
+  const groups = new Map;
+  for (const r of results) {
+    for (const c of r.candidates) {
+      const sig = `${c.sink?.category ?? "?"}|${c.source?.id ?? "unknown"}`;
+      const g = groups.get(sig);
+      if (g) {
+        g.occurrences += 1;
+        if (!g.files.includes(r.file))
+          g.files.push(r.file);
+      } else {
+        groups.set(sig, {
+          signature: sig,
+          root_cause: `unsanitized ${c.source?.label ?? "unknown"} reaching ${c.sink?.category ?? "sink"}`,
+          sink_category: c.sink?.category ?? "?",
+          cwe: c.sink?.cwe,
+          occurrences: 1,
+          files: [r.file]
+        });
+      }
+    }
+  }
+  return [...groups.values()].sort((a, b) => b.occurrences - a.occurrences);
+}
+
 // src/server.ts
 function createServer() {
   const server = new McpServer({
@@ -23665,6 +23837,35 @@ function createServer() {
   }, async ({ text }) => {
     return { content: [{ type: "text", text: JSON.stringify({ redacted: redactSecrets(text) }) }] };
   });
+  server.registerTool("trace_data_flow", {
+    title: "Trace source-to-sink data flow",
+    description: "EAGLE-EYE: trace data flow in a file — classify sources, sinks, sanitizers, and authorization gates. Returns candidates (reachable+unsanitized), sanitized (not findings), and authorized (lower priority).",
+    inputSchema: { path: string2().describe("Source file path") }
+  }, async ({ path }) => {
+    const r = traceDataFlow(path);
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
+  });
+  server.registerTool("variant_analysis", {
+    title: "Group findings by root cause",
+    description: "EAGLE-EYE: variant analysis — group data-flow candidates by root cause (sink category + source), deduplicating identical patterns across files.",
+    inputSchema: { path: string2().describe("Source directory path") }
+  }, async ({ path }) => {
+    await Promise.resolve().then(() => init_scanner());
+    const files = iterSourceFiles(path, 5000);
+    const results = files.map((f) => traceDataFlow(f));
+    const groups = groupVariants(results);
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          files_analyzed: files.length,
+          total_candidates: results.reduce((n, r) => n + r.candidates.length, 0),
+          variant_groups: groups.length,
+          groups
+        })
+      }]
+    };
+  });
   return server;
 }
 async function serve() {
@@ -23674,7 +23875,7 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync7, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
+import { readFileSync as readFileSync8, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
 import { join as join7, dirname } from "node:path";
 import { homedir as homedir3 } from "node:os";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
@@ -23756,7 +23957,7 @@ function resolveCommand() {
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync7(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
@@ -23799,7 +24000,7 @@ function copyOpenCodeAgents() {
     const src = join7(srcDir, f);
     const dst = join7(dstDir, f);
     if (existsSync6(src)) {
-      writeFileSync(dst, readFileSync7(src, "utf8"));
+      writeFileSync(dst, readFileSync8(src, "utf8"));
     }
   }
 }
@@ -23808,7 +24009,7 @@ function codexWrite(p) {
     const dir = dirname(p);
     if (!existsSync6(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync7(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync8(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -23827,7 +24028,7 @@ function hermesWrite(p) {
     const dir = dirname(p);
     if (!existsSync6(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync7(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync8(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -23965,7 +24166,7 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync9, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync10, existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 var ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
@@ -23973,7 +24174,7 @@ function readVersion() {
   try {
     const p = join9(ROOT6, "package.json");
     if (existsSync8(p))
-      return JSON.parse(readFileSync9(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync10(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {