blitzstrike 1.0.14 → 1.0.15

package/dist/index.js

@@ -7192,7 +7192,7 @@ var init_scanner = __esm(() => {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
 import { join as join8 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
@@ -7288,7 +7288,7 @@ function manualCopy(src, dst) {
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync2(d, readFileSync9(s));
+      writeFileSync2(d, readFileSync10(s));
   }
 }
 var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
@@ -23318,6 +23318,326 @@ function groupVariants(results) {
   return [...groups.values()].sort((a, b) => b.occurrences - a.occurrences);
 }
 
+// src/taint.ts
+init_scanner();
+import { readFileSync as readFileSync8 } from "node:fs";
+function lineIndexOf(text, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (text.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function extractVars(s) {
+  const out = [];
+  const re = /\$([A-Za-z_][A-Za-z0-9_]*)/g;
+  let m;
+  while ((m = re.exec(s)) !== null) {
+    if (!out.includes(m[1]))
+      out.push(m[1]);
+  }
+  return out;
+}
+function parseFunctions(text, lines) {
+  const scopes = [];
+  const re = /function\s+&?([A-Za-z_][A-Za-z0-9_]*)\s*\(([^)]*)\)/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const name = m[1];
+    const params = extractVars(m[2]);
+    const brace = text.indexOf("{", m.index + m[0].length);
+    if (brace === -1)
+      continue;
+    let depth = 0;
+    let end = -1;
+    for (let i = brace;i < text.length; i++) {
+      if (text[i] === "{")
+        depth++;
+      else if (text[i] === "}") {
+        depth--;
+        if (depth === 0) {
+          end = i;
+          break;
+        }
+      }
+    }
+    if (end === -1)
+      continue;
+    const startLine = lineIndexOf(text, m.index) - 1;
+    const endLine = lineIndexOf(text, end);
+    scopes.push({ name, start: startLine, end: endLine, params, isGlobal: false });
+  }
+  return scopes;
+}
+function isSourceExpr(expr) {
+  for (const token of Object.keys({ $_GET: 1, $_POST: 1, $_REQUEST: 1, $_COOKIE: 1, $_FILES: 1, $_SERVER: 1 })) {
+    if (expr.includes(token))
+      return token;
+  }
+  if (expr.includes("php://input") || expr.includes("file_get_contents('php://input')"))
+    return "php://input";
+  if (expr.includes("getallheaders"))
+    return "getallheaders";
+  return null;
+}
+function analyzeScope(text, lines, scope) {
+  const vars = new Map;
+  for (const p of scope.params)
+    vars.set(p, { tainted: false, sanitizers: [] });
+  const endLine = Math.min(scope.end, lines.length);
+  for (let li = scope.start;li < endLine; li++) {
+    const line = lines[li];
+    const assignRe = /\$([A-Za-z_][A-Za-z0-9_]*)\s*(?:\.?=)\s*(.+)/;
+    const am = assignRe.exec(line);
+    if (!am)
+      continue;
+    const varName = am[1];
+    const expr = am[2];
+    const src = isSourceExpr(expr);
+    if (src) {
+      vars.set(varName, { tainted: true, sanitizers: [], source: src, sourceLine: li + 1 });
+      continue;
+    }
+    const sanitizers = findSanitizers(expr);
+    const innerVars = extractVars(expr);
+    if (sanitizers.length > 0 && innerVars.length > 0) {
+      const inner = vars.get(innerVars[0]);
+      vars.set(varName, {
+        tainted: inner?.tainted ?? false,
+        sanitizers: [...inner?.sanitizers ?? [], ...sanitizers],
+        source: inner?.source,
+        sourceLine: inner?.sourceLine
+      });
+      continue;
+    }
+    let tainted = false;
+    let mergedSanitizers = [];
+    let source;
+    let sourceLine;
+    for (const v of innerVars) {
+      const st = vars.get(v);
+      if (st?.tainted) {
+        tainted = true;
+        mergedSanitizers = st.sanitizers;
+        source = st.source;
+        sourceLine = st.sourceLine;
+        break;
+      }
+    }
+    vars.set(varName, { tainted, sanitizers: mergedSanitizers, source, sourceLine });
+  }
+  return vars;
+}
+function buildSummaries(text, lines, scopes) {
+  const summaries = new Map;
+  for (const scope of scopes) {
+    if (scope.isGlobal)
+      continue;
+    const sinkParams = new Map;
+    const sanitizedParams = new Map;
+    const vars = analyzeScope(text, lines, scope);
+    const endLine = Math.min(scope.end, lines.length);
+    for (let li = scope.start;li < endLine; li++) {
+      const line = lines[li];
+      const inlineSan = findSanitizers(line);
+      if (inlineSan.length > 0) {
+        for (const p of scope.params) {
+          if (line.includes("$" + p)) {
+            const existing = sanitizedParams.get(p) ?? [];
+            sanitizedParams.set(p, [...existing, ...inlineSan]);
+          }
+        }
+      }
+      for (const sinkToken of Object.keys({
+        "->query(": 1,
+        "$wpdb->query": 1,
+        "$wpdb->get_var": 1,
+        "$wpdb->get_results": 1,
+        "system(": 1,
+        "exec(": 1,
+        "shell_exec(": 1,
+        "eval(": 1,
+        "unserialize(": 1,
+        "move_uploaded_file(": 1,
+        "file_put_contents(": 1,
+        include: 1,
+        require: 1,
+        "echo ": 1,
+        "print ": 1,
+        "header(": 1,
+        "wp_redirect(": 1,
+        "file_get_contents(": 1
+      })) {
+        if (!line.includes(sinkToken))
+          continue;
+        const varsInLine = extractVars(line);
+        for (const v of varsInLine) {
+          const st = vars.get(v);
+          if (st?.tainted) {
+            sinkParams.set(v, { sink: sinkToken, line: li + 1 });
+          }
+        }
+        for (const p of scope.params) {
+          if (line.includes("$" + p))
+            sinkParams.set(p, { sink: sinkToken, line: li + 1 });
+        }
+      }
+    }
+    summaries.set(scope.name, { name: scope.name, sinkParams, sanitizedParams });
+  }
+  return summaries;
+}
+function analyzeTaint(path) {
+  const result = { file: path, findings: [], suppressed: 0 };
+  let text;
+  try {
+    text = readFileSync8(path, "utf8");
+  } catch {
+    return result;
+  }
+  const lines = text.split(`
+`);
+  const scopes = parseFunctions(text, lines);
+  const summaries = buildSummaries(text, lines, scopes);
+  const globalScope = { name: "<global>", start: 0, end: lines.length, params: [], isGlobal: true };
+  const allScopes = [...scopes, globalScope];
+  for (const scope of allScopes) {
+    const vars = analyzeScope(text, lines, scope);
+    const endLine = Math.min(scope.end, lines.length);
+    for (let li = scope.start;li < endLine; li++) {
+      const line = lines[li];
+      const calledFn = /([A-Za-z_][A-Za-z0-9_]*)\s*\(/.exec(line);
+      if (calledFn && summaries.has(calledFn[1])) {
+        const sum = summaries.get(calledFn[1]);
+        const callVars = extractVars(line);
+        const passedTainted = callVars.filter((v) => vars.get(v)?.tainted);
+        if (passedTainted.length > 0 && sum.sinkParams.size > 0) {
+          const firstSink = [...sum.sinkParams.values()][0];
+          const cls = classifySink2(firstSink.sink);
+          if (cls) {
+            const st = vars.get(passedTainted[0]);
+            const inline = findSanitizers(line);
+            const helperSan = [...sum.sanitizedParams.values()].flat();
+            const san = [...st.sanitizers, ...inline, ...helperSan];
+            const authGated = AUTH_GATES.some((g) => line.includes(g) || (lines[li - 1] ?? "").includes(g));
+            if (!isSanitized(san, cls.id) && !authGated) {
+              result.findings.push({
+                sink: firstSink.sink,
+                sink_line: firstSink.line,
+                category: cls.category,
+                cwe: cls.cwe,
+                variables: passedTainted.map((v) => vars.get(v).source ?? "var"),
+                source: st.source,
+                source_line: st.sourceLine,
+                sanitized: false,
+                sanitizers: san.map((s) => s.id),
+                auth_gated: authGated,
+                interprocedural: true
+              });
+            } else {
+              result.suppressed += 1;
+            }
+            continue;
+          }
+        }
+      }
+      let sinkToken = null;
+      let sinkClass = null;
+      for (const tok of Object.keys({
+        "->query(": 1,
+        "$wpdb->query": 1,
+        "$wpdb->get_var": 1,
+        "$wpdb->get_results": 1,
+        "->whereRaw": 1,
+        "system(": 1,
+        "exec(": 1,
+        "shell_exec(": 1,
+        "passthru(": 1,
+        "popen(": 1,
+        "proc_open(": 1,
+        "eval(": 1,
+        "assert(": 1,
+        "unserialize(": 1,
+        "maybe_unserialize(": 1,
+        "move_uploaded_file(": 1,
+        "file_put_contents(": 1,
+        "fwrite(": 1,
+        include: 1,
+        require: 1,
+        "echo ": 1,
+        "print ": 1,
+        "printf(": 1,
+        "header(": 1,
+        "wp_redirect(": 1,
+        "file_get_contents(": 1,
+        "wp_remote_get(": 1,
+        "wp_remote_post(": 1
+      })) {
+        if (line.includes(tok)) {
+          const cls = classifySink2(tok);
+          if (cls) {
+            sinkToken = tok;
+            sinkClass = cls;
+            break;
+          }
+        }
+      }
+      if (!sinkToken || !sinkClass)
+        continue;
+      const varsInLine = extractVars(line);
+      const taintedVars = [];
+      const allSanitizers = [];
+      let source;
+      let sourceLine;
+      for (const v of varsInLine) {
+        const st = vars.get(v);
+        if (st?.tainted) {
+          taintedVars.push(st);
+          allSanitizers.push(...st.sanitizers);
+          if (!source) {
+            source = st.source;
+            sourceLine = st.sourceLine;
+          }
+        }
+      }
+      const inlineSource = isSourceExpr(line);
+      if (inlineSource && taintedVars.length === 0) {
+        taintedVars.push({ tainted: true, sanitizers: [], source: inlineSource, sourceLine: li + 1 });
+        source = inlineSource;
+        sourceLine = li + 1;
+      }
+      if (taintedVars.length === 0)
+        continue;
+      const inlineSanitizers = findSanitizers(line);
+      const sanitizers = [...allSanitizers, ...inlineSanitizers].filter((s, i, arr) => arr.indexOf(s) === i);
+      const authGated = AUTH_GATES.some((g) => line.includes(g) || (lines[li - 1] ?? "").includes(g));
+      const sanitized = isSanitized(sanitizers, sinkClass.id);
+      if (sanitized || authGated) {
+        result.suppressed += 1;
+        continue;
+      }
+      result.findings.push({
+        sink: sinkToken,
+        sink_line: li + 1,
+        category: sinkClass.category,
+        cwe: sinkClass.cwe,
+        variables: taintedVars.map((t) => t.source ?? "var").filter((v, i, a) => a.indexOf(v) === i),
+        source,
+        source_line: sourceLine,
+        sanitized,
+        sanitizers: sanitizers.map((s) => s.id),
+        auth_gated: authGated,
+        interprocedural: false
+      });
+    }
+  }
+  return result;
+}
+function taintTree(root, maxFiles = 2000) {
+  const files = iterSourceFiles(root, maxFiles);
+  return files.map((f) => analyzeTaint(f));
+}
+
 // src/server.ts
 function createServer() {
   const server = new McpServer({
@@ -23866,6 +24186,35 @@ function createServer() {
       }]
     };
   });
+  server.registerTool("taint_scan", {
+    title: "Inter-procedural taint analysis",
+    description: "EAGLE-EYE: real taint tracking — variable assignment, cross-function flow, and sanitizer awareness. Finds tainted data reaching sinks even across function boundaries.",
+    inputSchema: { path: string2().describe("Source file path") }
+  }, async ({ path }) => {
+    const r = analyzeTaint(path);
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
+  });
+  server.registerTool("taint_tree", {
+    title: "Whole-tree taint scan",
+    description: "EAGLE-EYE: run inter-procedural taint analysis across an entire source tree.",
+    inputSchema: {
+      path: string2().describe("Source directory path"),
+      max_files: number2().int().optional().describe("Max files (default 2000)")
+    }
+  }, async ({ path, max_files }) => {
+    const results = taintTree(path, max_files ?? 2000);
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          files_analyzed: results.length,
+          total_findings: results.reduce((n, r) => n + r.findings.length, 0),
+          total_suppressed: results.reduce((n, r) => n + r.suppressed, 0),
+          findings: results.filter((r) => r.findings.length > 0).map((r) => ({ file: r.file, findings: r.findings }))
+        })
+      }]
+    };
+  });
   return server;
 }
 async function serve() {
@@ -23875,7 +24224,7 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync8, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
+import { readFileSync as readFileSync9, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
 import { join as join7, dirname } from "node:path";
 import { homedir as homedir3 } from "node:os";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
@@ -23957,7 +24306,7 @@ function resolveCommand() {
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync8(p, "utf8"));
+    return JSON.parse(readFileSync9(p, "utf8"));
   } catch {
     return null;
   }
@@ -24000,7 +24349,7 @@ function copyOpenCodeAgents() {
     const src = join7(srcDir, f);
     const dst = join7(dstDir, f);
     if (existsSync6(src)) {
-      writeFileSync(dst, readFileSync8(src, "utf8"));
+      writeFileSync(dst, readFileSync9(src, "utf8"));
     }
   }
 }
@@ -24009,7 +24358,7 @@ function codexWrite(p) {
     const dir = dirname(p);
     if (!existsSync6(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync8(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync9(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -24028,7 +24377,7 @@ function hermesWrite(p) {
     const dir = dirname(p);
     if (!existsSync6(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync8(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync9(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -24166,7 +24515,7 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync10, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync11, existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 var ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
@@ -24174,7 +24523,7 @@ function readVersion() {
   try {
     const p = join9(ROOT6, "package.json");
     if (existsSync8(p))
-      return JSON.parse(readFileSync10(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync11(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {