blitzstrike 1.0.13 → 1.0.15

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
@@ -44,7 +43,6 @@ var __esm = (fn, res, err) => () => {
     throw err[0];
   return res;
 };
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS(function(exports) {
@@ -7156,7 +7154,12 @@ var init_scanner = __esm(() => {
     "call_user_func(": "Dynamic dispatch (attacker-controlled callback)",
     "call_user_func_array(": "Dynamic dispatch",
     "create_function(": "RCE (deprecated eval wrapper)",
-    "preg_replace(": "RCE (if /e modifier or code in pattern)"
+    "preg_replace(": "RCE (if /e modifier or code in pattern)",
+    "echo ": "XSS (reflected output)",
+    "print ": "XSS (reflected output)",
+    "printf(": "XSS (reflected output)",
+    "header(": "Open redirect / header injection",
+    "wp_redirect(": "Open redirect"
   };
   AUTH_GATES = [
     "check_ajax_referer",
@@ -7189,7 +7192,7 @@ var init_scanner = __esm(() => {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync8, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
 import { join as join8 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
@@ -7285,7 +7288,7 @@ function manualCopy(src, dst) {
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync2(d, readFileSync8(s));
+      writeFileSync2(d, readFileSync10(s));
   }
 }
 var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
@@ -23157,6 +23160,7 @@ async function activeScan(target, scope = "", mode = "bug-bounty", allowed = und
 
 // src/dataflow.ts
 init_scanner();
+import { readFileSync as readFileSync7 } from "node:fs";
 var SOURCES = {
   $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
   $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
@@ -23238,23 +23242,37 @@ function traceDataFlow(path) {
     return result;
   let text;
   try {
-    const { readFileSync } = __require("node:fs");
-    text = readFileSync(path, "utf8");
+    text = readFileSync7(path, "utf8");
   } catch {
     return result;
   }
   const lines = text.split(`
 `);
-  for (const s of scan.sinks) {
+  const seen = new Set;
+  const sinks = scan.sinks.filter((s) => {
+    const cls = classifySink2(s.sink);
+    if (!cls)
+      return false;
+    const key = `${cls.id}|${s.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+  for (const s of sinks) {
     const sinkClass = classifySink2(s.sink);
-    if (!sinkClass)
-      continue;
-    const start = Math.max(0, s.line - 15);
-    const window = lines.slice(start, s.line).join(`
+    const wideStart = Math.max(0, s.line - 15);
+    const wideWindow = lines.slice(wideStart, s.line).join(`
+`);
+    const sanitizerWindow = lines.slice(Math.max(0, s.line - 3), s.line + 1).join(`
 `);
-    const source = classifySource(window);
-    const sanitizers = findSanitizers(window);
-    const authGates = AUTH_GATES.filter((g) => window.includes(g));
+    const sinkLine = lines[s.line - 1] ?? "";
+    const prevLine = lines[s.line - 2] ?? "";
+    const authContext = sinkLine + `
+` + prevLine;
+    const source = classifySource(wideWindow);
+    const sanitizers = findSanitizers(sanitizerWindow);
+    const authGates = AUTH_GATES.filter((g) => authContext.includes(g));
     const edge = {
       source,
       sanitizers,
@@ -23267,7 +23285,7 @@ function traceDataFlow(path) {
       result.authorized.push(edge);
       continue;
     }
-    if (isSanitized(sanitizers, sinkClass.category)) {
+    if (isSanitized(sanitizers, sinkClass.id)) {
       result.sanitized.push(edge);
       continue;
     }
@@ -23300,6 +23318,326 @@ function groupVariants(results) {
   return [...groups.values()].sort((a, b) => b.occurrences - a.occurrences);
 }
 
+// src/taint.ts
+init_scanner();
+import { readFileSync as readFileSync8 } from "node:fs";
+function lineIndexOf(text, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (text.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function extractVars(s) {
+  const out = [];
+  const re = /\$([A-Za-z_][A-Za-z0-9_]*)/g;
+  let m;
+  while ((m = re.exec(s)) !== null) {
+    if (!out.includes(m[1]))
+      out.push(m[1]);
+  }
+  return out;
+}
+function parseFunctions(text, lines) {
+  const scopes = [];
+  const re = /function\s+&?([A-Za-z_][A-Za-z0-9_]*)\s*\(([^)]*)\)/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const name = m[1];
+    const params = extractVars(m[2]);
+    const brace = text.indexOf("{", m.index + m[0].length);
+    if (brace === -1)
+      continue;
+    let depth = 0;
+    let end = -1;
+    for (let i = brace;i < text.length; i++) {
+      if (text[i] === "{")
+        depth++;
+      else if (text[i] === "}") {
+        depth--;
+        if (depth === 0) {
+          end = i;
+          break;
+        }
+      }
+    }
+    if (end === -1)
+      continue;
+    const startLine = lineIndexOf(text, m.index) - 1;
+    const endLine = lineIndexOf(text, end);
+    scopes.push({ name, start: startLine, end: endLine, params, isGlobal: false });
+  }
+  return scopes;
+}
+function isSourceExpr(expr) {
+  for (const token of Object.keys({ $_GET: 1, $_POST: 1, $_REQUEST: 1, $_COOKIE: 1, $_FILES: 1, $_SERVER: 1 })) {
+    if (expr.includes(token))
+      return token;
+  }
+  if (expr.includes("php://input") || expr.includes("file_get_contents('php://input')"))
+    return "php://input";
+  if (expr.includes("getallheaders"))
+    return "getallheaders";
+  return null;
+}
+function analyzeScope(text, lines, scope) {
+  const vars = new Map;
+  for (const p of scope.params)
+    vars.set(p, { tainted: false, sanitizers: [] });
+  const endLine = Math.min(scope.end, lines.length);
+  for (let li = scope.start;li < endLine; li++) {
+    const line = lines[li];
+    const assignRe = /\$([A-Za-z_][A-Za-z0-9_]*)\s*(?:\.?=)\s*(.+)/;
+    const am = assignRe.exec(line);
+    if (!am)
+      continue;
+    const varName = am[1];
+    const expr = am[2];
+    const src = isSourceExpr(expr);
+    if (src) {
+      vars.set(varName, { tainted: true, sanitizers: [], source: src, sourceLine: li + 1 });
+      continue;
+    }
+    const sanitizers = findSanitizers(expr);
+    const innerVars = extractVars(expr);
+    if (sanitizers.length > 0 && innerVars.length > 0) {
+      const inner = vars.get(innerVars[0]);
+      vars.set(varName, {
+        tainted: inner?.tainted ?? false,
+        sanitizers: [...inner?.sanitizers ?? [], ...sanitizers],
+        source: inner?.source,
+        sourceLine: inner?.sourceLine
+      });
+      continue;
+    }
+    let tainted = false;
+    let mergedSanitizers = [];
+    let source;
+    let sourceLine;
+    for (const v of innerVars) {
+      const st = vars.get(v);
+      if (st?.tainted) {
+        tainted = true;
+        mergedSanitizers = st.sanitizers;
+        source = st.source;
+        sourceLine = st.sourceLine;
+        break;
+      }
+    }
+    vars.set(varName, { tainted, sanitizers: mergedSanitizers, source, sourceLine });
+  }
+  return vars;
+}
+function buildSummaries(text, lines, scopes) {
+  const summaries = new Map;
+  for (const scope of scopes) {
+    if (scope.isGlobal)
+      continue;
+    const sinkParams = new Map;
+    const sanitizedParams = new Map;
+    const vars = analyzeScope(text, lines, scope);
+    const endLine = Math.min(scope.end, lines.length);
+    for (let li = scope.start;li < endLine; li++) {
+      const line = lines[li];
+      const inlineSan = findSanitizers(line);
+      if (inlineSan.length > 0) {
+        for (const p of scope.params) {
+          if (line.includes("$" + p)) {
+            const existing = sanitizedParams.get(p) ?? [];
+            sanitizedParams.set(p, [...existing, ...inlineSan]);
+          }
+        }
+      }
+      for (const sinkToken of Object.keys({
+        "->query(": 1,
+        "$wpdb->query": 1,
+        "$wpdb->get_var": 1,
+        "$wpdb->get_results": 1,
+        "system(": 1,
+        "exec(": 1,
+        "shell_exec(": 1,
+        "eval(": 1,
+        "unserialize(": 1,
+        "move_uploaded_file(": 1,
+        "file_put_contents(": 1,
+        include: 1,
+        require: 1,
+        "echo ": 1,
+        "print ": 1,
+        "header(": 1,
+        "wp_redirect(": 1,
+        "file_get_contents(": 1
+      })) {
+        if (!line.includes(sinkToken))
+          continue;
+        const varsInLine = extractVars(line);
+        for (const v of varsInLine) {
+          const st = vars.get(v);
+          if (st?.tainted) {
+            sinkParams.set(v, { sink: sinkToken, line: li + 1 });
+          }
+        }
+        for (const p of scope.params) {
+          if (line.includes("$" + p))
+            sinkParams.set(p, { sink: sinkToken, line: li + 1 });
+        }
+      }
+    }
+    summaries.set(scope.name, { name: scope.name, sinkParams, sanitizedParams });
+  }
+  return summaries;
+}
+function analyzeTaint(path) {
+  const result = { file: path, findings: [], suppressed: 0 };
+  let text;
+  try {
+    text = readFileSync8(path, "utf8");
+  } catch {
+    return result;
+  }
+  const lines = text.split(`
+`);
+  const scopes = parseFunctions(text, lines);
+  const summaries = buildSummaries(text, lines, scopes);
+  const globalScope = { name: "<global>", start: 0, end: lines.length, params: [], isGlobal: true };
+  const allScopes = [...scopes, globalScope];
+  for (const scope of allScopes) {
+    const vars = analyzeScope(text, lines, scope);
+    const endLine = Math.min(scope.end, lines.length);
+    for (let li = scope.start;li < endLine; li++) {
+      const line = lines[li];
+      const calledFn = /([A-Za-z_][A-Za-z0-9_]*)\s*\(/.exec(line);
+      if (calledFn && summaries.has(calledFn[1])) {
+        const sum = summaries.get(calledFn[1]);
+        const callVars = extractVars(line);
+        const passedTainted = callVars.filter((v) => vars.get(v)?.tainted);
+        if (passedTainted.length > 0 && sum.sinkParams.size > 0) {
+          const firstSink = [...sum.sinkParams.values()][0];
+          const cls = classifySink2(firstSink.sink);
+          if (cls) {
+            const st = vars.get(passedTainted[0]);
+            const inline = findSanitizers(line);
+            const helperSan = [...sum.sanitizedParams.values()].flat();
+            const san = [...st.sanitizers, ...inline, ...helperSan];
+            const authGated = AUTH_GATES.some((g) => line.includes(g) || (lines[li - 1] ?? "").includes(g));
+            if (!isSanitized(san, cls.id) && !authGated) {
+              result.findings.push({
+                sink: firstSink.sink,
+                sink_line: firstSink.line,
+                category: cls.category,
+                cwe: cls.cwe,
+                variables: passedTainted.map((v) => vars.get(v).source ?? "var"),
+                source: st.source,
+                source_line: st.sourceLine,
+                sanitized: false,
+                sanitizers: san.map((s) => s.id),
+                auth_gated: authGated,
+                interprocedural: true
+              });
+            } else {
+              result.suppressed += 1;
+            }
+            continue;
+          }
+        }
+      }
+      let sinkToken = null;
+      let sinkClass = null;
+      for (const tok of Object.keys({
+        "->query(": 1,
+        "$wpdb->query": 1,
+        "$wpdb->get_var": 1,
+        "$wpdb->get_results": 1,
+        "->whereRaw": 1,
+        "system(": 1,
+        "exec(": 1,
+        "shell_exec(": 1,
+        "passthru(": 1,
+        "popen(": 1,
+        "proc_open(": 1,
+        "eval(": 1,
+        "assert(": 1,
+        "unserialize(": 1,
+        "maybe_unserialize(": 1,
+        "move_uploaded_file(": 1,
+        "file_put_contents(": 1,
+        "fwrite(": 1,
+        include: 1,
+        require: 1,
+        "echo ": 1,
+        "print ": 1,
+        "printf(": 1,
+        "header(": 1,
+        "wp_redirect(": 1,
+        "file_get_contents(": 1,
+        "wp_remote_get(": 1,
+        "wp_remote_post(": 1
+      })) {
+        if (line.includes(tok)) {
+          const cls = classifySink2(tok);
+          if (cls) {
+            sinkToken = tok;
+            sinkClass = cls;
+            break;
+          }
+        }
+      }
+      if (!sinkToken || !sinkClass)
+        continue;
+      const varsInLine = extractVars(line);
+      const taintedVars = [];
+      const allSanitizers = [];
+      let source;
+      let sourceLine;
+      for (const v of varsInLine) {
+        const st = vars.get(v);
+        if (st?.tainted) {
+          taintedVars.push(st);
+          allSanitizers.push(...st.sanitizers);
+          if (!source) {
+            source = st.source;
+            sourceLine = st.sourceLine;
+          }
+        }
+      }
+      const inlineSource = isSourceExpr(line);
+      if (inlineSource && taintedVars.length === 0) {
+        taintedVars.push({ tainted: true, sanitizers: [], source: inlineSource, sourceLine: li + 1 });
+        source = inlineSource;
+        sourceLine = li + 1;
+      }
+      if (taintedVars.length === 0)
+        continue;
+      const inlineSanitizers = findSanitizers(line);
+      const sanitizers = [...allSanitizers, ...inlineSanitizers].filter((s, i, arr) => arr.indexOf(s) === i);
+      const authGated = AUTH_GATES.some((g) => line.includes(g) || (lines[li - 1] ?? "").includes(g));
+      const sanitized = isSanitized(sanitizers, sinkClass.id);
+      if (sanitized || authGated) {
+        result.suppressed += 1;
+        continue;
+      }
+      result.findings.push({
+        sink: sinkToken,
+        sink_line: li + 1,
+        category: sinkClass.category,
+        cwe: sinkClass.cwe,
+        variables: taintedVars.map((t) => t.source ?? "var").filter((v, i, a) => a.indexOf(v) === i),
+        source,
+        source_line: sourceLine,
+        sanitized,
+        sanitizers: sanitizers.map((s) => s.id),
+        auth_gated: authGated,
+        interprocedural: false
+      });
+    }
+  }
+  return result;
+}
+function taintTree(root, maxFiles = 2000) {
+  const files = iterSourceFiles(root, maxFiles);
+  return files.map((f) => analyzeTaint(f));
+}
+
 // src/server.ts
 function createServer() {
   const server = new McpServer({
@@ -23848,6 +24186,35 @@ function createServer() {
       }]
     };
   });
+  server.registerTool("taint_scan", {
+    title: "Inter-procedural taint analysis",
+    description: "EAGLE-EYE: real taint tracking — variable assignment, cross-function flow, and sanitizer awareness. Finds tainted data reaching sinks even across function boundaries.",
+    inputSchema: { path: string2().describe("Source file path") }
+  }, async ({ path }) => {
+    const r = analyzeTaint(path);
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
+  });
+  server.registerTool("taint_tree", {
+    title: "Whole-tree taint scan",
+    description: "EAGLE-EYE: run inter-procedural taint analysis across an entire source tree.",
+    inputSchema: {
+      path: string2().describe("Source directory path"),
+      max_files: number2().int().optional().describe("Max files (default 2000)")
+    }
+  }, async ({ path, max_files }) => {
+    const results = taintTree(path, max_files ?? 2000);
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          files_analyzed: results.length,
+          total_findings: results.reduce((n, r) => n + r.findings.length, 0),
+          total_suppressed: results.reduce((n, r) => n + r.suppressed, 0),
+          findings: results.filter((r) => r.findings.length > 0).map((r) => ({ file: r.file, findings: r.findings }))
+        })
+      }]
+    };
+  });
   return server;
 }
 async function serve() {
@@ -23857,7 +24224,7 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync7, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
+import { readFileSync as readFileSync9, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
 import { join as join7, dirname } from "node:path";
 import { homedir as homedir3 } from "node:os";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
@@ -23939,7 +24306,7 @@ function resolveCommand() {
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync7(p, "utf8"));
+    return JSON.parse(readFileSync9(p, "utf8"));
   } catch {
     return null;
   }
@@ -23982,7 +24349,7 @@ function copyOpenCodeAgents() {
     const src = join7(srcDir, f);
     const dst = join7(dstDir, f);
     if (existsSync6(src)) {
-      writeFileSync(dst, readFileSync7(src, "utf8"));
+      writeFileSync(dst, readFileSync9(src, "utf8"));
     }
   }
 }
@@ -23991,7 +24358,7 @@ function codexWrite(p) {
     const dir = dirname(p);
     if (!existsSync6(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync7(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync9(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -24010,7 +24377,7 @@ function hermesWrite(p) {
     const dir = dirname(p);
     if (!existsSync6(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync7(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync9(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -24148,7 +24515,7 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync9, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync11, existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 var ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
@@ -24156,7 +24523,7 @@ function readVersion() {
   try {
     const p = join9(ROOT6, "package.json");
     if (existsSync8(p))
-      return JSON.parse(readFileSync9(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync11(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {