blitzstrike 1.0.13 → 1.0.14

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
@@ -44,7 +43,6 @@ var __esm = (fn, res, err) => () => {
     throw err[0];
   return res;
 };
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS(function(exports) {
@@ -7156,7 +7154,12 @@ var init_scanner = __esm(() => {
     "call_user_func(": "Dynamic dispatch (attacker-controlled callback)",
     "call_user_func_array(": "Dynamic dispatch",
     "create_function(": "RCE (deprecated eval wrapper)",
-    "preg_replace(": "RCE (if /e modifier or code in pattern)"
+    "preg_replace(": "RCE (if /e modifier or code in pattern)",
+    "echo ": "XSS (reflected output)",
+    "print ": "XSS (reflected output)",
+    "printf(": "XSS (reflected output)",
+    "header(": "Open redirect / header injection",
+    "wp_redirect(": "Open redirect"
   };
   AUTH_GATES = [
     "check_ajax_referer",
@@ -7189,7 +7192,7 @@ var init_scanner = __esm(() => {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync8, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
 import { join as join8 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
@@ -7285,7 +7288,7 @@ function manualCopy(src, dst) {
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync2(d, readFileSync8(s));
+      writeFileSync2(d, readFileSync9(s));
   }
 }
 var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
@@ -23157,6 +23160,7 @@ async function activeScan(target, scope = "", mode = "bug-bounty", allowed = und
 
 // src/dataflow.ts
 init_scanner();
+import { readFileSync as readFileSync7 } from "node:fs";
 var SOURCES = {
   $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
   $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
@@ -23238,23 +23242,37 @@ function traceDataFlow(path) {
     return result;
   let text;
   try {
-    const { readFileSync } = __require("node:fs");
-    text = readFileSync(path, "utf8");
+    text = readFileSync7(path, "utf8");
   } catch {
     return result;
   }
   const lines = text.split(`
 `);
-  for (const s of scan.sinks) {
+  const seen = new Set;
+  const sinks = scan.sinks.filter((s) => {
+    const cls = classifySink2(s.sink);
+    if (!cls)
+      return false;
+    const key = `${cls.id}|${s.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+  for (const s of sinks) {
     const sinkClass = classifySink2(s.sink);
-    if (!sinkClass)
-      continue;
-    const start = Math.max(0, s.line - 15);
-    const window = lines.slice(start, s.line).join(`
+    const wideStart = Math.max(0, s.line - 15);
+    const wideWindow = lines.slice(wideStart, s.line).join(`
+`);
+    const sanitizerWindow = lines.slice(Math.max(0, s.line - 3), s.line + 1).join(`
 `);
-    const source = classifySource(window);
-    const sanitizers = findSanitizers(window);
-    const authGates = AUTH_GATES.filter((g) => window.includes(g));
+    const sinkLine = lines[s.line - 1] ?? "";
+    const prevLine = lines[s.line - 2] ?? "";
+    const authContext = sinkLine + `
+` + prevLine;
+    const source = classifySource(wideWindow);
+    const sanitizers = findSanitizers(sanitizerWindow);
+    const authGates = AUTH_GATES.filter((g) => authContext.includes(g));
     const edge = {
       source,
       sanitizers,
@@ -23267,7 +23285,7 @@ function traceDataFlow(path) {
       result.authorized.push(edge);
       continue;
     }
-    if (isSanitized(sanitizers, sinkClass.category)) {
+    if (isSanitized(sanitizers, sinkClass.id)) {
       result.sanitized.push(edge);
       continue;
     }
@@ -23857,7 +23875,7 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync7, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
+import { readFileSync as readFileSync8, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
 import { join as join7, dirname } from "node:path";
 import { homedir as homedir3 } from "node:os";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
@@ -23939,7 +23957,7 @@ function resolveCommand() {
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync7(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
@@ -23982,7 +24000,7 @@ function copyOpenCodeAgents() {
     const src = join7(srcDir, f);
     const dst = join7(dstDir, f);
     if (existsSync6(src)) {
-      writeFileSync(dst, readFileSync7(src, "utf8"));
+      writeFileSync(dst, readFileSync8(src, "utf8"));
     }
   }
 }
@@ -23991,7 +24009,7 @@ function codexWrite(p) {
     const dir = dirname(p);
     if (!existsSync6(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync7(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync8(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -24010,7 +24028,7 @@ function hermesWrite(p) {
     const dir = dirname(p);
     if (!existsSync6(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync7(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync8(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -24148,7 +24166,7 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync9, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync10, existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 var ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
@@ -24156,7 +24174,7 @@ function readVersion() {
   try {
     const p = join9(ROOT6, "package.json");
     if (existsSync8(p))
-      return JSON.parse(readFileSync9(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync10(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {