blitzstrike 1.0.35 → 1.0.36

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.36] — 2026-09-13
+
+### Added
+
+- **Phase 3 — Benchmark expansion** (`scripts/generate-corpus.py` + 70-fixture corpus):
+  - Corpus grown 10 → **70 fixtures** (49 vulnerable + 21 patched/safe), covering
+    11 sink types × 4 languages (PHP/JS/Python/Java) × vulnerable/patched pairs.
+  - Benchmark now scores **detection 1.0 / FP 0 / FN 0 / precision 1.0**.
+  - Benchmark PHP fixtures now run through **EAGLE-EYE 2.0** (`analyzeDataFlow2`),
+    so return/byref/ternary/transitive cases are measured.
+
+### Fixed (engine gaps exposed by the expanded corpus)
+
+- **PHP**: `include`/`require`/`include_once`/`require_once` and `eval` are
+  statement nodes (not calls) — now handled as sinks.
+- **PHP**: `sinkClassOf` now prefixes `$` to property-lookup bases, so
+  `$wpdb->get_var`/`$wpdb->get_results` are classified correctly.
+- **PHP**: method chains (`DB::table()->whereRaw()->get()`) — nested sinks are
+  now detected by recursing into the chain base.
+- **PHP**: `in_array`/`preg_match`/`ctype_*`/`is_numeric` whitelist guards are
+  recognized as input-validation gates (sinks inside them are suppressed).
+- **PHP**: `wp_safe_redirect` is the *safe* redirect (removed from the redirect sink).
+- **Universal adapters**: added SSRF sinks (JS `http.get`/`axios`, Python
+  `requests.*`, Java `new URL`/`openConnection`), path-traversal (JS
+  `fs.readFile`), and XXE (Java `DocumentBuilder`/`SAXParser`).
+- **Universal adapters**: parameterized SQL (`?` placeholder + params) and
+  Python `subprocess` list-form (no shell) are now recognized as safe.
+
 ## [1.0.35] — 2026-09-13
 
 ### Added

package/bench/corpus/java-cmd-vuln.md

@@ -0,0 +1,8 @@
+- id: java-cmd-vuln
+- language: java
+- vulnerable: true
+- sink_type: command_execution
+```java
+String cmd = request.getParameter("cmd");
+Runtime.getRuntime().exec(cmd);
+```

package/bench/corpus/java-deser-vuln.md

@@ -0,0 +1,8 @@
+- id: java-deser-vuln
+- language: java
+- vulnerable: true
+- sink_type: deserialization
+```java
+ObjectInputStream ois = new ObjectInputStream(request.getInputStream());
+ois.readObject();
+```

package/bench/corpus/java-sqli-prep.md

@@ -0,0 +1,9 @@
+- id: java-sqli-prep
+- language: java
+- vulnerable: false
+- sink_type: sql_execution
+```java
+String id = request.getParameter("id");
+PreparedStatement ps = conn.prepareStatement("SELECT * FROM t WHERE id=?");
+ps.setString(1, id);
+```

package/bench/corpus/java-sqli-vuln.md

@@ -0,0 +1,9 @@
+- id: java-sqli-vuln
+- language: java
+- vulnerable: true
+- sink_type: sql_execution
+```java
+String id = request.getParameter("id");
+Statement st = conn.createStatement();
+st.executeQuery("SELECT * FROM t WHERE id=" + id);
+```

package/bench/corpus/java-ssrf-vuln.md

@@ -0,0 +1,9 @@
+- id: java-ssrf-vuln
+- language: java
+- vulnerable: true
+- sink_type: http_request
+```java
+String url = request.getParameter("url");
+URL u = new URL(url);
+u.openConnection();
+```

package/bench/corpus/java-xss-vuln.md

@@ -0,0 +1,8 @@
+- id: java-xss-vuln
+- language: java
+- vulnerable: true
+- sink_type: html_render
+```java
+String x = request.getParameter("x");
+response.getWriter().write(x);
+```

package/bench/corpus/java-xxe-vuln.md

@@ -0,0 +1,10 @@
+- id: java-xxe-vuln
+- language: java
+- vulnerable: true
+- sink_type: xml_processing
+```java
+InputStream in = request.getInputStream();
+DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+DocumentBuilder db = dbf.newDocumentBuilder();
+db.parse(in);
+```

package/bench/corpus/js-cmd-spawn.md

@@ -0,0 +1,8 @@
+- id: js-cmd-spawn
+- language: javascript
+- vulnerable: false
+- sink_type: command_execution
+```javascript
+const c = req.query.cmd;
+spawn("ls", [c]);
+```

package/bench/corpus/js-cmd-vuln.md

@@ -0,0 +1,8 @@
+- id: js-cmd-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: command_execution
+```javascript
+const c = req.query.cmd;
+exec("ls " + c);
+```

package/bench/corpus/js-eval-vuln.md

@@ -0,0 +1,8 @@
+- id: js-eval-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: code_execution
+```javascript
+const c = req.body.code;
+eval(c);
+```

package/bench/corpus/js-pathtraversal-vuln.md

@@ -0,0 +1,8 @@
+- id: js-pathtraversal-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: file_operations
+```javascript
+const f = req.query.file;
+fs.readFile("/data/" + f);
+```

package/bench/corpus/js-redirect-vuln.md

@@ -0,0 +1,8 @@
+- id: js-redirect-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: redirect
+```javascript
+const u = req.query.url;
+res.redirect(u);
+```

package/bench/corpus/js-sqli-param.md

@@ -0,0 +1,8 @@
+- id: js-sqli-param
+- language: javascript
+- vulnerable: false
+- sink_type: sql_execution
+```javascript
+const id = req.query.id;
+db.query("SELECT * FROM t WHERE id=?", [id]);
+```

package/bench/corpus/js-ssrf-vuln.md

@@ -0,0 +1,8 @@
+- id: js-ssrf-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: http_request
+```javascript
+const u = req.query.url;
+http.get(u, cb);
+```

package/bench/corpus/{js-xss-sanitized.md → js-xss-escape.md}

@@ -1,4 +1,4 @@
-- id: js-xss-sanitized
+- id: js-xss-escape
 - language: javascript
 - vulnerable: false
 - sink_type: html_render

package/bench/corpus/js-xss-vuln.md

@@ -0,0 +1,8 @@
+- id: js-xss-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: html_render
+```javascript
+const x = req.query.x;
+res.send(x);
+```

package/bench/corpus/php-cmd-authgated.md

@@ -0,0 +1,8 @@
+- id: php-cmd-authgated
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+if (is_user_logged_in()) { system($_GET["c"]); }
+```

package/bench/corpus/php-cmd-byref.md

@@ -0,0 +1,11 @@
+- id: php-cmd-byref
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+function fill(&$out) { $out = $_GET["cmd"]; }
+$c = "";
+fill($c);
+system($c);
+```

package/bench/corpus/php-cmd-escaped.md

@@ -0,0 +1,9 @@
+- id: php-cmd-escaped
+- language: php
+- vulnerable: false
+- sink_type: command_execution
+```php
+<?php
+$cmd = $_GET["cmd"];
+system(escapeshellarg($cmd));
+```

package/bench/corpus/php-cmd-escapeshellcmd.md

@@ -0,0 +1,9 @@
+- id: php-cmd-escapeshellcmd
+- language: php
+- vulnerable: false
+- sink_type: command_execution
+```php
+<?php
+$c = $_GET["c"];
+system(escapeshellcmd($c));
+```

package/bench/corpus/php-cmd-intval.md

@@ -0,0 +1,9 @@
+- id: php-cmd-intval
+- language: php
+- vulnerable: false
+- sink_type: command_execution
+```php
+<?php
+$n = $_GET["n"];
+system("ping -c " . intval($n));
+```

package/bench/corpus/php-cmd-passthru.md

@@ -0,0 +1,9 @@
+- id: php-cmd-passthru
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+$cmd = $_GET["cmd"];
+passthru($cmd);
+```

package/bench/corpus/php-cmd-shell-exec.md

@@ -0,0 +1,9 @@
+- id: php-cmd-shell-exec
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+$cmd = $_GET["cmd"];
+shell_exec($cmd);
+```

package/bench/corpus/php-cmd-transitive.md

@@ -0,0 +1,10 @@
+- id: php-cmd-transitive
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+function a($v) { b($v); }
+function b($v) { system($v); }
+a($_GET["cmd"]);
+```

package/bench/corpus/{php-command-injection-vuln.md → php-cmd-vuln.md}

@@ -1,4 +1,4 @@
-- id: php-command-injection-vuln
+- id: php-cmd-vuln
 - language: php
 - vulnerable: true
 - sink_type: command_execution

package/bench/corpus/php-codeexec-assert.md

@@ -0,0 +1,9 @@
+- id: php-codeexec-assert
+- language: php
+- vulnerable: true
+- sink_type: code_execution
+```php
+<?php
+$code = $_GET["code"];
+assert($code);
+```

package/bench/corpus/php-codeexec-vuln.md

@@ -0,0 +1,9 @@
+- id: php-codeexec-vuln
+- language: php
+- vulnerable: true
+- sink_type: code_execution
+```php
+<?php
+$code = $_GET["code"];
+eval($code);
+```

package/bench/corpus/php-fileupload-name.md

@@ -0,0 +1,9 @@
+- id: php-fileupload-name
+- language: php
+- vulnerable: true
+- sink_type: file_operations
+```php
+<?php
+$f = $_FILES["f"];
+move_uploaded_file($f["tmp_name"], $f["name"]);
+```

package/bench/corpus/php-fileupload-sanitized.md

@@ -0,0 +1,9 @@
+- id: php-fileupload-sanitized
+- language: php
+- vulnerable: false
+- sink_type: file_operations
+```php
+<?php
+$f = $_FILES["u"];
+move_uploaded_file($f["tmp_name"], "/uploads/" . sanitize_file_name($f["name"]));
+```

package/bench/corpus/php-fileupload-vuln.md

@@ -0,0 +1,9 @@
+- id: php-fileupload-vuln
+- language: php
+- vulnerable: true
+- sink_type: file_operations
+```php
+<?php
+$f = $_FILES["u"];
+move_uploaded_file($f["tmp_name"], "/uploads/" . $f["name"]);
+```

package/bench/corpus/php-filewrite-vuln.md

@@ -0,0 +1,9 @@
+- id: php-filewrite-vuln
+- language: php
+- vulnerable: true
+- sink_type: file_operations
+```php
+<?php
+$data = $_POST["data"];
+file_put_contents("/tmp/log.txt", $data);
+```

package/bench/corpus/php-include-intval.md

@@ -0,0 +1,9 @@
+- id: php-include-intval
+- language: php
+- vulnerable: false
+- sink_type: file_inclusion
+```php
+<?php
+$id = $_GET["id"];
+include("/pages/" . intval($id) . ".php");
+```

package/bench/corpus/php-include-require.md

@@ -0,0 +1,9 @@
+- id: php-include-require
+- language: php
+- vulnerable: true
+- sink_type: file_inclusion
+```php
+<?php
+$m = $_GET["m"];
+require($m . ".php");
+```

package/bench/corpus/php-include-vuln.md

@@ -0,0 +1,9 @@
+- id: php-include-vuln
+- language: php
+- vulnerable: true
+- sink_type: file_inclusion
+```php
+<?php
+$page = $_GET["page"];
+include($page . ".php");
+```

package/bench/corpus/php-include-whitelist.md

@@ -0,0 +1,10 @@
+- id: php-include-whitelist
+- language: php
+- vulnerable: false
+- sink_type: file_inclusion
+```php
+<?php
+$page = $_GET["page"];
+$allow = ["home", "about"];
+if (in_array($page, $allow)) { include($page . ".php"); }
+```

package/bench/corpus/php-redirect-safe.md

@@ -0,0 +1,9 @@
+- id: php-redirect-safe
+- language: php
+- vulnerable: false
+- sink_type: redirect
+```php
+<?php
+$url = $_GET["url"];
+wp_safe_redirect($url);
+```

package/bench/corpus/php-redirect-vuln.md

@@ -0,0 +1,9 @@
+- id: php-redirect-vuln
+- language: php
+- vulnerable: true
+- sink_type: redirect
+```php
+<?php
+$url = $_GET["url"];
+header("Location: " . $url);
+```

package/bench/corpus/php-sqli-authgated.md

@@ -0,0 +1,9 @@
+- id: php-sqli-authgated
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+function del($id) { if (current_user_can("x")) { global $wpdb; $wpdb->query("DELETE FROM t WHERE id=$id"); } }
+del($_GET["id"]);
+```

package/bench/corpus/php-sqli-esc.md

@@ -0,0 +1,9 @@
+- id: php-sqli-esc
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+$id = $_GET["id"];
+$q = $wpdb->query("SELECT * FROM t WHERE id=" . esc_sql($id));
+```

package/bench/corpus/php-sqli-filter.md

@@ -0,0 +1,9 @@
+- id: php-sqli-filter
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+$id = filter_var($_GET["id"], FILTER_VALIDATE_INT);
+$wpdb->query("SELECT * FROM t WHERE id=$id");
+```

package/bench/corpus/php-sqli-getvar.md

@@ -0,0 +1,9 @@
+- id: php-sqli-getvar
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+$id = $_GET["id"];
+$wpdb->get_var("SELECT name FROM t WHERE id=$id");
+```

package/bench/corpus/php-sqli-interproc.md

@@ -0,0 +1,10 @@
+- id: php-sqli-interproc
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+function run_q($id) { global $wpdb; $wpdb->query("SELECT * FROM t WHERE id=$id"); }
+$id = $_GET["id"];
+run_q($id);
+```

package/bench/corpus/php-sqli-whereraw.md

@@ -0,0 +1,9 @@
+- id: php-sqli-whereraw
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+$id = $_GET["id"];
+DB::table("t")->whereRaw("id = $id")->get();
+```

package/bench/corpus/php-ssrf-curl.md

@@ -0,0 +1,11 @@
+- id: php-ssrf-curl
+- language: php
+- vulnerable: true
+- sink_type: http_request
+```php
+<?php
+$u = $_GET["u"];
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_URL, $u);
+curl_exec($ch);
+```

package/bench/corpus/php-ssrf-vuln.md

@@ -0,0 +1,9 @@
+- id: php-ssrf-vuln
+- language: php
+- vulnerable: true
+- sink_type: http_request
+```php
+<?php
+$url = $_GET["url"];
+file_get_contents($url);
+```

package/bench/corpus/php-ssrf-wpremote.md

@@ -0,0 +1,9 @@
+- id: php-ssrf-wpremote
+- language: php
+- vulnerable: true
+- sink_type: http_request
+```php
+<?php
+$url = $_GET["url"];
+wp_remote_get($url);
+```

package/bench/corpus/php-unserialize-vuln.md

@@ -0,0 +1,9 @@
+- id: php-unserialize-vuln
+- language: php
+- vulnerable: true
+- sink_type: deserialization
+```php
+<?php
+$data = $_COOKIE["data"];
+unserialize($data);
+```

package/bench/corpus/php-xss-attr.md

@@ -0,0 +1,9 @@
+- id: php-xss-attr
+- language: php
+- vulnerable: false
+- sink_type: html_render
+```php
+<?php
+$v = $_GET["v"];
+echo esc_attr($v);
+```

package/bench/corpus/php-xss-authgated.md

@@ -0,0 +1,8 @@
+- id: php-xss-authgated
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+if (current_user_can("edit")) { echo $_GET["x"]; }
+```

package/bench/corpus/php-xss-eschtml.md

@@ -0,0 +1,9 @@
+- id: php-xss-eschtml
+- language: php
+- vulnerable: false
+- sink_type: html_render
+```php
+<?php
+$name = $_GET["name"];
+echo esc_html($name);
+```

package/bench/corpus/php-xss-htmlentities.md

@@ -0,0 +1,9 @@
+- id: php-xss-htmlentities
+- language: php
+- vulnerable: false
+- sink_type: html_render
+```php
+<?php
+$v = $_GET["v"];
+echo htmlentities($v);
+```

package/bench/corpus/php-xss-return.md

@@ -0,0 +1,9 @@
+- id: php-xss-return
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+function id($x) { return $x; }
+echo id($_GET["q"]);
+```

package/bench/corpus/php-xss-ternary.md

@@ -0,0 +1,9 @@
+- id: php-xss-ternary
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+$t = isset($_GET["t"]) ? $_GET["t"] : "safe";
+echo $t;
+```

package/bench/corpus/php-xss-vuln.md

@@ -0,0 +1,9 @@
+- id: php-xss-vuln
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+$name = $_GET["name"];
+echo $name;
+```

package/bench/corpus/php-xxe-vuln.md

@@ -0,0 +1,9 @@
+- id: php-xxe-vuln
+- language: php
+- vulnerable: true
+- sink_type: xml_processing
+```php
+<?php
+$xml = $_POST["xml"];
+simplexml_load_string($xml);
+```

package/bench/corpus/php-zipslip-vuln.md

@@ -0,0 +1,10 @@
+- id: php-zipslip-vuln
+- language: php
+- vulnerable: true
+- sink_type: archive_extraction
+```php
+<?php
+$dest = $_GET["dest"];
+$zip = new ZipArchive();
+$zip->extractTo($dest);
+```

package/bench/corpus/py-cmd-subprocess.md

@@ -0,0 +1,9 @@
+- id: py-cmd-subprocess
+- language: python
+- vulnerable: false
+- sink_type: command_execution
+```python
+import subprocess
+cmd = request.args.get("cmd")
+subprocess.run(["ls", cmd])
+```

package/bench/corpus/{py-command-injection-vuln.md → py-cmd-vuln.md}

@@ -1,9 +1,9 @@
-- id: py-command-injection-vuln
+- id: py-cmd-vuln
 - language: python
 - vulnerable: true
 - sink_type: command_execution
 ```python
 import os
-x = request.args.get("cmd")
-os.system(x)
+cmd = request.args.get("cmd")
+os.system(cmd)
 ```

package/bench/corpus/py-deser-json.md

@@ -0,0 +1,9 @@
+- id: py-deser-json
+- language: python
+- vulnerable: false
+- sink_type: deserialization
+```python
+import json
+data = request.get_data()
+json.loads(data)
+```

package/bench/corpus/py-deser-vuln.md

@@ -0,0 +1,9 @@
+- id: py-deser-vuln
+- language: python
+- vulnerable: true
+- sink_type: deserialization
+```python
+import pickle
+data = request.get_data()
+pickle.loads(data)
+```

package/bench/corpus/py-eval-vuln.md

@@ -0,0 +1,8 @@
+- id: py-eval-vuln
+- language: python
+- vulnerable: true
+- sink_type: code_execution
+```python
+code = request.args.get("code")
+eval(code)
+```

package/bench/corpus/py-pathtraversal-vuln.md

@@ -0,0 +1,8 @@
+- id: py-pathtraversal-vuln
+- language: python
+- vulnerable: true
+- sink_type: file_operations
+```python
+f = request.args.get("file")
+open("/data/" + f)
+```

package/bench/corpus/py-sqli-param.md

@@ -0,0 +1,9 @@
+- id: py-sqli-param
+- language: python
+- vulnerable: false
+- sink_type: sql_execution
+```python
+import sqlite3
+id = request.args.get("id")
+cursor.execute("SELECT * FROM t WHERE id=?", (id,))
+```

package/bench/corpus/py-sqli-vuln.md

@@ -0,0 +1,9 @@
+- id: py-sqli-vuln
+- language: python
+- vulnerable: true
+- sink_type: sql_execution
+```python
+import sqlite3
+id = request.args.get("id")
+cursor.execute(f"SELECT * FROM t WHERE id={id}")
+```

package/bench/corpus/py-ssrf-vuln.md

@@ -0,0 +1,9 @@
+- id: py-ssrf-vuln
+- language: python
+- vulnerable: true
+- sink_type: http_request
+```python
+import requests
+url = request.args.get("url")
+requests.get(url)
+```

package/bench/corpus/py-xss-vuln.md

@@ -0,0 +1,8 @@
+- id: py-xss-vuln
+- language: python
+- vulnerable: true
+- sink_type: html_render
+```python
+name = request.args.get("name")
+return render_template_string("<p>" + name + "</p>")
+```

package/dist/index.js

@@ -31072,8 +31072,8 @@ var SINK_CLASS_MAP = [
   [/\bmove_uploaded_file\(|\bfile_put_contents\(|\bfwrite\(|\bfopen\(|\bunlink\(/, { id: "file_operations", category: "File operations", cwe: "CWE-434" }],
   [/\binclude\(|\brequire\(|\binclude_once\(|\brequire_once\(/, { id: "file_inclusion", category: "File inclusion", cwe: "CWE-98" }],
   [/\bunserialize\(|\bmaybe_unserialize\(/, { id: "deserialization", category: "Deserialization", cwe: "CWE-502" }],
-  [/\bwp_remote_get\(|\bwp_remote_post\(|\bfile_get_contents\(|\bcurl_exec\(/, { id: "http_request", category: "HTTP request (SSRF)", cwe: "CWE-918" }],
-  [/\bheader\(|\bwp_redirect\(|\bwp_safe_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
+  [/\bwp_remote_get\(|\bwp_remote_post\(|\bfile_get_contents\(|\bcurl_exec\(|\bcurl_setopt\(/, { id: "http_request", category: "HTTP request (SSRF)", cwe: "CWE-918" }],
+  [/\bheader\(|\bwp_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
   [/echo\s|print\s|\bprintf\(/, { id: "html_render", category: "HTML rendering (XSS)", cwe: "CWE-79" }],
   [/\bsimplexml_load_string\(|new SimpleXMLElement|DOMDocument/, { id: "xml_processing", category: "XML processing (XXE)", cwe: "CWE-611" }],
   [/\bZipArchive|\bPharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }]
@@ -31859,9 +31859,11 @@ function sinkClassOf2(call) {
     return null;
   let token = "";
   if (what.kind === "propertylookup") {
-    const base = rootVarName2(what.what);
+    const baseNode = what.what;
+    const base = rootVarName2(baseNode);
     const method = what.offset?.name ?? what.offset?.value;
-    token = `${base}->${method}(`;
+    const baseStr = isNode3(baseNode) && (baseNode.kind === "variable" || baseNode.kind === "offsetlookup") ? `$${base}` : base;
+    token = `${baseStr}->${method}(`;
   } else if (what.kind === "name") {
     token = `${what.name}(`;
   }
@@ -31918,26 +31920,27 @@ function summarizeFunction(fn, id, name, summaries) {
   }
   return summary;
 }
-function analyzeBody(statements, env, summary, ctx, taintedParam, props, activeAuth, summaries) {
+function analyzeBody(statements, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating = false) {
   for (const stmt of statements) {
     if (!isNode3(stmt))
       continue;
     const kind = stmt.kind;
     if (kind === "expressionstatement") {
-      analyzeExpr(stmt.expression, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      analyzeExpr(stmt.expression, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     } else if (kind === "if") {
       const condGates = authGatesOf(stmt.test);
       const branchAuth = [...activeAuth, ...condGates];
+      const condValidating = validationGatesOf(stmt.test);
       const thenStmts = stmt.body?.kind === "block" ? stmt.body.children ?? [] : [stmt.body];
       const thenEnv = cloneEnv(env);
       const thenCtx = { sinks: [], returnsTainted: false, calls: [] };
-      analyzeBody(thenStmts, thenEnv, summary, thenCtx, taintedParam, cloneProps(props), branchAuth, summaries);
+      analyzeBody(thenStmts, thenEnv, summary, thenCtx, taintedParam, cloneProps(props), branchAuth, summaries, validating || condValidating);
       mergeCtx(ctx, thenCtx);
       if (stmt.alternate) {
         const altStmts = stmt.alternate.kind === "block" ? stmt.alternate.children ?? [] : [stmt.alternate];
         const altEnv = cloneEnv(env);
         const altCtx = { sinks: [], returnsTainted: false, calls: [] };
-        analyzeBody(altStmts, altEnv, summary, altCtx, taintedParam, cloneProps(props), activeAuth, summaries);
+        analyzeBody(altStmts, altEnv, summary, altCtx, taintedParam, cloneProps(props), activeAuth, summaries, validating);
         mergeCtx(ctx, altCtx);
         for (const [k, v] of thenEnv) {
           const alt = altEnv.get(k);
@@ -31948,25 +31951,25 @@ function analyzeBody(statements, env, summary, ctx, taintedParam, props, activeA
           env.set(k, v);
       }
     } else if (kind === "block") {
-      analyzeBody(stmt.children ?? [], env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      analyzeBody(stmt.children ?? [], env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     } else if (kind === "return") {
-      const t = analyzeExpr(stmt.expr, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      const t = analyzeExpr(stmt.expr, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
       if (t.tainted)
         ctx.returnsTainted = true;
     } else if (kind === "echo" || kind === "print") {
-      analyzeExpr(stmt, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      analyzeExpr(stmt, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     } else {
       for (const c of children3(stmt)) {
         if (c.kind === "block" || c.kind === "if") {
-          analyzeBody([c], env, summary, ctx, taintedParam, props, activeAuth, summaries);
+          analyzeBody([c], env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
         } else {
-          analyzeExpr(c, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+          analyzeExpr(c, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
         }
       }
     }
   }
 }
-function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, summaries) {
+function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating = false) {
   if (!isNode3(node))
     return CLEAN;
   const src = sourceOf2(node);
@@ -31974,7 +31977,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
     return { tainted: true, sources: [src], sanitizers: [], sourceLine: node.loc?.start?.line };
   if (node.kind === "assign") {
     const byref = node.operator === "=&";
-    const rhs = analyzeExpr(node.right, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+    const rhs = analyzeExpr(node.right, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     const lhs = node.left;
     if (isNode3(lhs) && lhs.kind === "variable") {
       const varName = lhs.name;
@@ -32006,7 +32009,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
   }
   if (node.kind === "call") {
     const sink = sinkClassOf2(node);
-    const argTaints = node.arguments.map((a) => analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries));
+    const argTaints = node.arguments.map((a) => analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating));
     const taintedArgs = argTaints.filter((t) => t.tainted);
     if (sink) {
       if (taintedArgs.length > 0) {
@@ -32016,7 +32019,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
         ctx.sinks.push({ sink: sink.token, line: node.loc?.start?.line ?? 0, sanitized, authGated: gates.length > 0, authGates: gates });
       }
       for (const a of node.arguments)
-        analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+        analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
       return taintedArgs.length > 0 ? mergeTaint(...taintedArgs) : CLEAN;
     }
     const fnName = rootVarName2(node.what);
@@ -32059,6 +32062,9 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
         }
       }
     }
+    if (isNode3(node.what) && node.what.kind === "propertylookup") {
+      analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    }
     return CLEAN;
   }
   if (node.kind === "variable") {
@@ -32072,7 +32078,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
       if (t)
         return { ...t };
     }
-    return analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+    return analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
   }
   if (node.kind === "propertylookup") {
     const objName = rootVarName2(node.what);
@@ -32082,35 +32088,55 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
       if (pt)
         return { ...pt };
     }
-    return analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+    return analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
   }
   if (node.kind === "retif") {
-    const t = analyzeExpr(node.trueExpr ?? node.test, env, summary, ctx, taintedParam, props, activeAuth, summaries);
-    const f = node.falseExpr ? analyzeExpr(node.falseExpr, env, summary, ctx, taintedParam, props, activeAuth, summaries) : CLEAN;
+    const t = analyzeExpr(node.trueExpr ?? node.test, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    const f = node.falseExpr ? analyzeExpr(node.falseExpr, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating) : CLEAN;
     return mergeTaint(t, f);
   }
   if (node.kind === "bin" || node.kind === "concat" || node.kind === "encapsed") {
     const parts = children3(node);
-    const taints = parts.map((p) => analyzeExpr(p, env, summary, ctx, taintedParam, props, activeAuth, summaries));
+    const taints = parts.map((p) => analyzeExpr(p, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating));
     return mergeTaint(...taints);
   }
   if (node.kind === "encapsedpart") {
-    return analyzeExpr(node.expression, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+    return analyzeExpr(node.expression, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
   }
   if (node.kind === "echo" || node.kind === "print") {
     const exprs = node.expressions ?? [node.expression];
     const cls = classifySink2(node.kind === "echo" ? "echo " : "print ");
     let ret = CLEAN;
     for (const e of exprs) {
-      const t = analyzeExpr(e, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      const t = analyzeExpr(e, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
       if (t.tainted && cls) {
         const san = [...t.sanitizers, ...findSanitizers(JSON.stringify(e))];
-        ctx.sinks.push({ sink: node.kind + " ", line: node.loc?.start?.line ?? 0, sanitized: isSanitized(san, cls.id), authGated: activeAuth.length > 0, authGates: activeAuth });
+        ctx.sinks.push({ sink: node.kind + " ", line: node.loc?.start?.line ?? 0, sanitized: isSanitized(san, cls.id) || validating, authGated: activeAuth.length > 0, authGates: activeAuth });
       }
       ret = mergeTaint(ret, t);
     }
     return ret;
   }
+  if (node.kind === "include") {
+    const base = node.require ? "require" : "include";
+    const suffix = node.once ? "_once" : "";
+    const sinkToken = base + suffix + "(";
+    const cls = classifySink2(sinkToken);
+    const t = analyzeExpr(node.target, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    if (t.tainted && cls) {
+      const san = [...t.sanitizers, ...findSanitizers(JSON.stringify(node))];
+      ctx.sinks.push({ sink: sinkToken, line: node.loc?.start?.line ?? 0, sanitized: isSanitized(san, cls.id) || validating, authGated: activeAuth.length > 0, authGates: activeAuth });
+    }
+    return t;
+  }
+  if (node.kind === "eval") {
+    const cls = classifySink2("eval(");
+    const t = analyzeExpr(node.source, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    if (t.tainted && cls) {
+      ctx.sinks.push({ sink: "eval(", line: node.loc?.start?.line ?? 0, sanitized: false, authGated: activeAuth.length > 0, authGates: activeAuth });
+    }
+    return t;
+  }
   return CLEAN;
 }
 function cloneEnv(env) {
@@ -32133,6 +32159,13 @@ function authGatesOf(node) {
     return [];
   return AUTH_GATES.filter((g) => JSON.stringify(node).includes(g));
 }
+var VALIDATION_GATES = ["in_array", "preg_match", "ctype_digit", "ctype_alnum", "is_numeric"];
+function validationGatesOf(node) {
+  if (!isNode3(node))
+    return false;
+  const text = JSON.stringify(node);
+  return VALIDATION_GATES.some((g) => text.includes(g));
+}
 function collectDecls(ast, out) {
   walkDecls(ast, out);
 }
@@ -50346,8 +50379,13 @@ var JS_SINKS = [
   [/document\.write/i, "html_render", "CWE-79"],
   [/fs\.writeFile/i, "file_operations", "CWE-434"],
   [/fs\.appendFile/i, "file_operations", "CWE-434"],
+  [/fs\.readFile/i, "path_traversal", "CWE-22"],
+  [/fs\.readFileSync/i, "path_traversal", "CWE-22"],
+  [/fs\.unlink/i, "file_operations", "CWE-434"],
   [/require\s*\(/i, "file_inclusion", "CWE-98"],
   [/fetch\s*\(/i, "http_request", "CWE-918"],
+  [/http\.get|https\.get|axios/i, "http_request", "CWE-918"],
+  [/http\.request|https\.request/i, "http_request", "CWE-918"],
   [/redirect\s*\(/i, "redirect", "CWE-601"],
   [/res\.redirect/i, "redirect", "CWE-601"]
 ];
@@ -50434,6 +50472,8 @@ var jsAdapter = {
             argVars.push(c.name);
         for (const [re, kind, cwe] of JS_SINKS) {
           if (re.test(fullCallText) || re.test(calleeText + "(")) {
+            if (kind === "sql_execution" && /\?/.test(fullCallText) && /,\s*\[/.test(fullCallText))
+              continue;
             for (const v of argVars)
               sinks.push({ variable: v, kind, line: n.loc?.start?.line ?? 0, cwe });
           }
@@ -50472,6 +50512,8 @@ var PY_SINKS = [
   [/\.save\s*\(/i, "file_operations", "CWE-434"],
   [/render_template/i, "html_render", "CWE-79"],
   [/redirect\s*\(/i, "redirect", "CWE-601"],
+  [/requests\.(get|post|put|head|request)\s*\(/i, "http_request", "CWE-918"],
+  [/urllib\.request/i, "http_request", "CWE-918"],
   [/pickle\.loads\s*\(/i, "deserialization", "CWE-502"],
   [/yaml\.load\s*\(/i, "deserialization", "CWE-502"],
   [/os\.popen\s*\(/i, "command_execution", "CWE-78"],
@@ -50556,9 +50598,14 @@ var pythonAdapter = {
           if (m[1] !== callee.trim().split(".").pop())
             argVars.push(m[1]);
         for (const [re, kind, cwe] of PY_SINKS) {
-          if (re.test(full))
-            for (const v of argVars)
-              sinks.push({ variable: v, kind, line: lineOf(n), cwe });
+          if (!re.test(full))
+            continue;
+          if (kind === "sql_execution" && /\?/.test(full) && /,\s*\(/.test(full))
+            continue;
+          if (kind === "command_execution" && /subprocess/.test(full) && /\[/.test(full))
+            continue;
+          for (const v of argVars)
+            sinks.push({ variable: v, kind, line: lineOf(n), cwe });
         }
         for (const [re, kinds] of PY_SANITIZERS) {
           if (re.test(full))
@@ -50594,6 +50641,10 @@ var JAVA_SINKS = [
   [/readObject\s*\(/i, "deserialization", "CWE-502"],
   [/new File\s*\(/i, "file_operations", "CWE-434"],
   [/\.getInputStream\s*\(/i, "http_request", "CWE-918"],
+  [/new URL\s*\(/i, "http_request", "CWE-918"],
+  [/openConnection\s*\(/i, "http_request", "CWE-918"],
+  [/DocumentBuilder|SAXParser|XMLReader/i, "xml_processing", "CWE-611"],
+  [/\.parse\s*\(/i, "xml_processing", "CWE-611"],
   [/sendRedirect\s*\(/i, "redirect", "CWE-601"],
   [/\.forward\s*\(/i, "redirect", "CWE-601"]
 ];
@@ -51547,7 +51598,7 @@ function detect(entry) {
   if (lang === "php") {
     const tmp = join9(tmpdir(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync2(tmp, entry.code);
-    const r = analyzeTaint(tmp);
+    const r = analyzeDataFlow2(tmp);
     rmSync(tmp, { force: true });
     if (r.findings.length > 0)
       return { detected: true, sinkKind: r.findings[0].sink };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.35",
+  "version": "1.0.36",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/bench/corpus/java-command-injection-vuln.md

@@ -1,7 +0,0 @@
-- id: java-command-injection-vuln
-- language: java
-- vulnerable: true
-- sink_type: command_execution
-```java
-class A { void f() { String cmd = request.getParameter("cmd"); Runtime.getRuntime().exec(cmd); } }
-```

package/bench/corpus/php-file-upload-vuln.md

@@ -1,9 +0,0 @@
-- id: php-file-upload-vuln
-- language: php
-- vulnerable: true
-- sink_type: file_operations
-```php
-<?php
-$file = $_FILES["upload"];
-move_uploaded_file($file["tmp_name"], "/uploads/" . $file["name"]);
-```

package/bench/corpus/py-command-injection-sanitized.md

@@ -1,9 +0,0 @@
-- id: py-command-injection-sanitized
-- language: python
-- vulnerable: false
-- sink_type: command_execution
-```python
-import os, shlex
-x = request.args.get("cmd")
-os.system(shlex.quote(x))
-```