blitzstrike 1.0.34 → 1.0.38

package/CHANGELOG.md

@@ -5,6 +5,89 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.38] — 2026-09-13
+
+### Fixed (Phase 4 review)
+
+- `diff_analyze` ignored the `language` argument for non-PHP code (bare `file`
+  without an extension resolved to `unknown`, silently returning 0 findings).
+  The engine now derives a probe extension from the declared language.
+- `eagle_eye2` now surfaces `entry_points` (uncalled functions = potential unauth
+  entry points) and `unreachable` (dead code) — previously computed but hidden.
+- Removed the unused `call_graph` field from `Eagle2Result.summary` (Map/Set-based,
+  not JSON-safe, never consumed).
+- Removed the dead `nextCorrelationId` export from `audit.ts`.
+
+## [1.0.37] — 2026-09-13
+
+### Added
+
+- **Phase 4 — Differential security analysis** (`src/differential.ts`):
+  - `analyzeDifferential(old, new, language)` — compares two code versions and
+    surfaces only security-sensitive changes:
+    - **new vulnerability** (source→sink path present only in new code — authoritative, engine-backed)
+    - **fixed vulnerability** (path present only in old code)
+    - **new sink** / **new source** (line-level hints)
+    - **sanitizer removed** / **authorization removed** (high-severity signals)
+  - `analyzeDifferentialFiles(old_path, new_path)` — file-based comparison.
+  - `analyzeGitDiff(repo, base, head)` — runs across a git commit range.
+  - New MCP tool `diff_analyze` (supports file-pair, code-pair, or git-diff mode).
+
+## [1.0.36] — 2026-09-13
+
+### Added
+
+- **Phase 3 — Benchmark expansion** (`scripts/generate-corpus.py` + 70-fixture corpus):
+  - Corpus grown 10 → **70 fixtures** (49 vulnerable + 21 patched/safe), covering
+    11 sink types × 4 languages (PHP/JS/Python/Java) × vulnerable/patched pairs.
+  - Benchmark now scores **detection 1.0 / FP 0 / FN 0 / precision 1.0**.
+  - Benchmark PHP fixtures now run through **EAGLE-EYE 2.0** (`analyzeDataFlow2`),
+    so return/byref/ternary/transitive cases are measured.
+
+### Fixed (engine gaps exposed by the expanded corpus)
+
+- **PHP**: `include`/`require`/`include_once`/`require_once` and `eval` are
+  statement nodes (not calls) — now handled as sinks.
+- **PHP**: `sinkClassOf` now prefixes `$` to property-lookup bases, so
+  `$wpdb->get_var`/`$wpdb->get_results` are classified correctly.
+- **PHP**: method chains (`DB::table()->whereRaw()->get()`) — nested sinks are
+  now detected by recursing into the chain base.
+- **PHP**: `in_array`/`preg_match`/`ctype_*`/`is_numeric` whitelist guards are
+  recognized as input-validation gates (sinks inside them are suppressed).
+- **PHP**: `wp_safe_redirect` is the *safe* redirect (removed from the redirect sink).
+- **Universal adapters**: added SSRF sinks (JS `http.get`/`axios`, Python
+  `requests.*`, Java `new URL`/`openConnection`), path-traversal (JS
+  `fs.readFile`), and XXE (Java `DocumentBuilder`/`SAXParser`).
+- **Universal adapters**: parameterized SQL (`?` placeholder + params) and
+  Python `subprocess` list-form (no shell) are now recognized as safe.
+
+## [1.0.35] — 2026-09-13
+
+### Added
+
+- **Phase 2 — EAGLE-EYE 2.0** (`src/callgraph.ts` + `src/eagle2.ts`):
+  - **Call graph** — sound (over-approximate) function/method resolution on a
+    PHP AST: name calls, `$this->m()`, static calls, and Class Hierarchy
+    Analysis (CHA) for `$obj->m()`.
+  - **Whole-program interprocedural taint** — call-graph worklist propagates
+    taint transitively across function boundaries (`outer -> inner -> sink`).
+  - **Return propagation** — `$x = helper($tainted)` taints `$x` iff the helper
+    returns a value derived from its parameter.
+  - **By-reference alias tracking** — `&$out` output params that write a source
+    taint the caller's variable.
+  - **Conditional flow** — ternary (`retif`) + if/else branches are merged
+    (sources unioned, sanitizers intersected — sound).
+  - **Authorization flow** — sinks guarded by a capability/nonce check are
+    flagged `auth_gated` with the *specific* gate name.
+  - New MCP tool `eagle_eye2` — prefer over `taint_scan` for accurate
+    cross-function reachability.
+
+### Fixed
+
+- Sink classification false positives: bare function-name sinks (`system(`, `exec(`, …)
+  now use `\b` word boundaries, so `outer_exec(...)` is no longer misclassified
+  as command execution.
+
 ## [1.0.33] — 2026-09-13
 
 ### Added

package/bench/corpus/java-cmd-vuln.md

@@ -0,0 +1,8 @@
+- id: java-cmd-vuln
+- language: java
+- vulnerable: true
+- sink_type: command_execution
+```java
+String cmd = request.getParameter("cmd");
+Runtime.getRuntime().exec(cmd);
+```

package/bench/corpus/java-deser-vuln.md

@@ -0,0 +1,8 @@
+- id: java-deser-vuln
+- language: java
+- vulnerable: true
+- sink_type: deserialization
+```java
+ObjectInputStream ois = new ObjectInputStream(request.getInputStream());
+ois.readObject();
+```

package/bench/corpus/java-sqli-prep.md

@@ -0,0 +1,9 @@
+- id: java-sqli-prep
+- language: java
+- vulnerable: false
+- sink_type: sql_execution
+```java
+String id = request.getParameter("id");
+PreparedStatement ps = conn.prepareStatement("SELECT * FROM t WHERE id=?");
+ps.setString(1, id);
+```

package/bench/corpus/java-sqli-vuln.md

@@ -0,0 +1,9 @@
+- id: java-sqli-vuln
+- language: java
+- vulnerable: true
+- sink_type: sql_execution
+```java
+String id = request.getParameter("id");
+Statement st = conn.createStatement();
+st.executeQuery("SELECT * FROM t WHERE id=" + id);
+```

package/bench/corpus/java-ssrf-vuln.md

@@ -0,0 +1,9 @@
+- id: java-ssrf-vuln
+- language: java
+- vulnerable: true
+- sink_type: http_request
+```java
+String url = request.getParameter("url");
+URL u = new URL(url);
+u.openConnection();
+```

package/bench/corpus/java-xss-vuln.md

@@ -0,0 +1,8 @@
+- id: java-xss-vuln
+- language: java
+- vulnerable: true
+- sink_type: html_render
+```java
+String x = request.getParameter("x");
+response.getWriter().write(x);
+```

package/bench/corpus/java-xxe-vuln.md

@@ -0,0 +1,10 @@
+- id: java-xxe-vuln
+- language: java
+- vulnerable: true
+- sink_type: xml_processing
+```java
+InputStream in = request.getInputStream();
+DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+DocumentBuilder db = dbf.newDocumentBuilder();
+db.parse(in);
+```

package/bench/corpus/js-cmd-spawn.md

@@ -0,0 +1,8 @@
+- id: js-cmd-spawn
+- language: javascript
+- vulnerable: false
+- sink_type: command_execution
+```javascript
+const c = req.query.cmd;
+spawn("ls", [c]);
+```

package/bench/corpus/js-cmd-vuln.md

@@ -0,0 +1,8 @@
+- id: js-cmd-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: command_execution
+```javascript
+const c = req.query.cmd;
+exec("ls " + c);
+```

package/bench/corpus/js-eval-vuln.md

@@ -0,0 +1,8 @@
+- id: js-eval-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: code_execution
+```javascript
+const c = req.body.code;
+eval(c);
+```

package/bench/corpus/js-pathtraversal-vuln.md

@@ -0,0 +1,8 @@
+- id: js-pathtraversal-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: file_operations
+```javascript
+const f = req.query.file;
+fs.readFile("/data/" + f);
+```

package/bench/corpus/js-redirect-vuln.md

@@ -0,0 +1,8 @@
+- id: js-redirect-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: redirect
+```javascript
+const u = req.query.url;
+res.redirect(u);
+```

package/bench/corpus/js-sqli-param.md

@@ -0,0 +1,8 @@
+- id: js-sqli-param
+- language: javascript
+- vulnerable: false
+- sink_type: sql_execution
+```javascript
+const id = req.query.id;
+db.query("SELECT * FROM t WHERE id=?", [id]);
+```

package/bench/corpus/js-ssrf-vuln.md

@@ -0,0 +1,8 @@
+- id: js-ssrf-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: http_request
+```javascript
+const u = req.query.url;
+http.get(u, cb);
+```

package/bench/corpus/{js-xss-sanitized.md → js-xss-escape.md}

@@ -1,4 +1,4 @@
-- id: js-xss-sanitized
+- id: js-xss-escape
 - language: javascript
 - vulnerable: false
 - sink_type: html_render

package/bench/corpus/js-xss-vuln.md

@@ -0,0 +1,8 @@
+- id: js-xss-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: html_render
+```javascript
+const x = req.query.x;
+res.send(x);
+```

package/bench/corpus/php-cmd-authgated.md

@@ -0,0 +1,8 @@
+- id: php-cmd-authgated
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+if (is_user_logged_in()) { system($_GET["c"]); }
+```

package/bench/corpus/php-cmd-byref.md

@@ -0,0 +1,11 @@
+- id: php-cmd-byref
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+function fill(&$out) { $out = $_GET["cmd"]; }
+$c = "";
+fill($c);
+system($c);
+```

package/bench/corpus/php-cmd-escaped.md

@@ -0,0 +1,9 @@
+- id: php-cmd-escaped
+- language: php
+- vulnerable: false
+- sink_type: command_execution
+```php
+<?php
+$cmd = $_GET["cmd"];
+system(escapeshellarg($cmd));
+```

package/bench/corpus/php-cmd-escapeshellcmd.md

@@ -0,0 +1,9 @@
+- id: php-cmd-escapeshellcmd
+- language: php
+- vulnerable: false
+- sink_type: command_execution
+```php
+<?php
+$c = $_GET["c"];
+system(escapeshellcmd($c));
+```

package/bench/corpus/php-cmd-intval.md

@@ -0,0 +1,9 @@
+- id: php-cmd-intval
+- language: php
+- vulnerable: false
+- sink_type: command_execution
+```php
+<?php
+$n = $_GET["n"];
+system("ping -c " . intval($n));
+```

package/bench/corpus/php-cmd-passthru.md

@@ -0,0 +1,9 @@
+- id: php-cmd-passthru
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+$cmd = $_GET["cmd"];
+passthru($cmd);
+```

package/bench/corpus/php-cmd-shell-exec.md

@@ -0,0 +1,9 @@
+- id: php-cmd-shell-exec
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+$cmd = $_GET["cmd"];
+shell_exec($cmd);
+```

package/bench/corpus/php-cmd-transitive.md

@@ -0,0 +1,10 @@
+- id: php-cmd-transitive
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+function a($v) { b($v); }
+function b($v) { system($v); }
+a($_GET["cmd"]);
+```

package/bench/corpus/{php-command-injection-vuln.md → php-cmd-vuln.md}

@@ -1,4 +1,4 @@
-- id: php-command-injection-vuln
+- id: php-cmd-vuln
 - language: php
 - vulnerable: true
 - sink_type: command_execution

package/bench/corpus/php-codeexec-assert.md

@@ -0,0 +1,9 @@
+- id: php-codeexec-assert
+- language: php
+- vulnerable: true
+- sink_type: code_execution
+```php
+<?php
+$code = $_GET["code"];
+assert($code);
+```

package/bench/corpus/php-codeexec-vuln.md

@@ -0,0 +1,9 @@
+- id: php-codeexec-vuln
+- language: php
+- vulnerable: true
+- sink_type: code_execution
+```php
+<?php
+$code = $_GET["code"];
+eval($code);
+```

package/bench/corpus/php-fileupload-name.md

@@ -0,0 +1,9 @@
+- id: php-fileupload-name
+- language: php
+- vulnerable: true
+- sink_type: file_operations
+```php
+<?php
+$f = $_FILES["f"];
+move_uploaded_file($f["tmp_name"], $f["name"]);
+```

package/bench/corpus/php-fileupload-sanitized.md

@@ -0,0 +1,9 @@
+- id: php-fileupload-sanitized
+- language: php
+- vulnerable: false
+- sink_type: file_operations
+```php
+<?php
+$f = $_FILES["u"];
+move_uploaded_file($f["tmp_name"], "/uploads/" . sanitize_file_name($f["name"]));
+```

package/bench/corpus/php-fileupload-vuln.md

@@ -0,0 +1,9 @@
+- id: php-fileupload-vuln
+- language: php
+- vulnerable: true
+- sink_type: file_operations
+```php
+<?php
+$f = $_FILES["u"];
+move_uploaded_file($f["tmp_name"], "/uploads/" . $f["name"]);
+```

package/bench/corpus/php-filewrite-vuln.md

@@ -0,0 +1,9 @@
+- id: php-filewrite-vuln
+- language: php
+- vulnerable: true
+- sink_type: file_operations
+```php
+<?php
+$data = $_POST["data"];
+file_put_contents("/tmp/log.txt", $data);
+```

package/bench/corpus/php-include-intval.md

@@ -0,0 +1,9 @@
+- id: php-include-intval
+- language: php
+- vulnerable: false
+- sink_type: file_inclusion
+```php
+<?php
+$id = $_GET["id"];
+include("/pages/" . intval($id) . ".php");
+```

package/bench/corpus/php-include-require.md

@@ -0,0 +1,9 @@
+- id: php-include-require
+- language: php
+- vulnerable: true
+- sink_type: file_inclusion
+```php
+<?php
+$m = $_GET["m"];
+require($m . ".php");
+```

package/bench/corpus/php-include-vuln.md

@@ -0,0 +1,9 @@
+- id: php-include-vuln
+- language: php
+- vulnerable: true
+- sink_type: file_inclusion
+```php
+<?php
+$page = $_GET["page"];
+include($page . ".php");
+```

package/bench/corpus/php-include-whitelist.md

@@ -0,0 +1,10 @@
+- id: php-include-whitelist
+- language: php
+- vulnerable: false
+- sink_type: file_inclusion
+```php
+<?php
+$page = $_GET["page"];
+$allow = ["home", "about"];
+if (in_array($page, $allow)) { include($page . ".php"); }
+```

package/bench/corpus/php-redirect-safe.md

@@ -0,0 +1,9 @@
+- id: php-redirect-safe
+- language: php
+- vulnerable: false
+- sink_type: redirect
+```php
+<?php
+$url = $_GET["url"];
+wp_safe_redirect($url);
+```

package/bench/corpus/php-redirect-vuln.md

@@ -0,0 +1,9 @@
+- id: php-redirect-vuln
+- language: php
+- vulnerable: true
+- sink_type: redirect
+```php
+<?php
+$url = $_GET["url"];
+header("Location: " . $url);
+```

package/bench/corpus/php-sqli-authgated.md

@@ -0,0 +1,9 @@
+- id: php-sqli-authgated
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+function del($id) { if (current_user_can("x")) { global $wpdb; $wpdb->query("DELETE FROM t WHERE id=$id"); } }
+del($_GET["id"]);
+```

package/bench/corpus/php-sqli-esc.md

@@ -0,0 +1,9 @@
+- id: php-sqli-esc
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+$id = $_GET["id"];
+$q = $wpdb->query("SELECT * FROM t WHERE id=" . esc_sql($id));
+```

package/bench/corpus/php-sqli-filter.md

@@ -0,0 +1,9 @@
+- id: php-sqli-filter
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+$id = filter_var($_GET["id"], FILTER_VALIDATE_INT);
+$wpdb->query("SELECT * FROM t WHERE id=$id");
+```

package/bench/corpus/php-sqli-getvar.md

@@ -0,0 +1,9 @@
+- id: php-sqli-getvar
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+$id = $_GET["id"];
+$wpdb->get_var("SELECT name FROM t WHERE id=$id");
+```

package/bench/corpus/php-sqli-interproc.md

@@ -0,0 +1,10 @@
+- id: php-sqli-interproc
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+function run_q($id) { global $wpdb; $wpdb->query("SELECT * FROM t WHERE id=$id"); }
+$id = $_GET["id"];
+run_q($id);
+```

package/bench/corpus/php-sqli-whereraw.md

@@ -0,0 +1,9 @@
+- id: php-sqli-whereraw
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+$id = $_GET["id"];
+DB::table("t")->whereRaw("id = $id")->get();
+```

package/bench/corpus/php-ssrf-curl.md

@@ -0,0 +1,11 @@
+- id: php-ssrf-curl
+- language: php
+- vulnerable: true
+- sink_type: http_request
+```php
+<?php
+$u = $_GET["u"];
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_URL, $u);
+curl_exec($ch);
+```

package/bench/corpus/php-ssrf-vuln.md

@@ -0,0 +1,9 @@
+- id: php-ssrf-vuln
+- language: php
+- vulnerable: true
+- sink_type: http_request
+```php
+<?php
+$url = $_GET["url"];
+file_get_contents($url);
+```

package/bench/corpus/php-ssrf-wpremote.md

@@ -0,0 +1,9 @@
+- id: php-ssrf-wpremote
+- language: php
+- vulnerable: true
+- sink_type: http_request
+```php
+<?php
+$url = $_GET["url"];
+wp_remote_get($url);
+```

package/bench/corpus/php-unserialize-vuln.md

@@ -0,0 +1,9 @@
+- id: php-unserialize-vuln
+- language: php
+- vulnerable: true
+- sink_type: deserialization
+```php
+<?php
+$data = $_COOKIE["data"];
+unserialize($data);
+```

package/bench/corpus/php-xss-attr.md

@@ -0,0 +1,9 @@
+- id: php-xss-attr
+- language: php
+- vulnerable: false
+- sink_type: html_render
+```php
+<?php
+$v = $_GET["v"];
+echo esc_attr($v);
+```

package/bench/corpus/php-xss-authgated.md

@@ -0,0 +1,8 @@
+- id: php-xss-authgated
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+if (current_user_can("edit")) { echo $_GET["x"]; }
+```

package/bench/corpus/php-xss-eschtml.md

@@ -0,0 +1,9 @@
+- id: php-xss-eschtml
+- language: php
+- vulnerable: false
+- sink_type: html_render
+```php
+<?php
+$name = $_GET["name"];
+echo esc_html($name);
+```

package/bench/corpus/php-xss-htmlentities.md

@@ -0,0 +1,9 @@
+- id: php-xss-htmlentities
+- language: php
+- vulnerable: false
+- sink_type: html_render
+```php
+<?php
+$v = $_GET["v"];
+echo htmlentities($v);
+```

package/bench/corpus/php-xss-return.md

@@ -0,0 +1,9 @@
+- id: php-xss-return
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+function id($x) { return $x; }
+echo id($_GET["q"]);
+```

package/bench/corpus/php-xss-ternary.md

@@ -0,0 +1,9 @@
+- id: php-xss-ternary
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+$t = isset($_GET["t"]) ? $_GET["t"] : "safe";
+echo $t;
+```

package/bench/corpus/php-xss-vuln.md

@@ -0,0 +1,9 @@
+- id: php-xss-vuln
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+$name = $_GET["name"];
+echo $name;
+```