blitzstrike 1.0.38 → 1.0.40

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.40] — 2026-09-13
+
+### Changed (review + spec alignment)
+
+- **Coverage Matrix 2.0 (§57)**: `coverageMatrix()` now also tracks the framework
+  dimension — per-framework sinks/sources/sanitizers/auth counts + CWE set.
+- **Benchmark 100+ (§65)**: corpus grown 70 → **101 fixtures** (70 vulnerable +
+  31 patched), still scoring detection 1.0 / FP 0 / FN 0 / precision 1.0.
+
+### Fixed
+
+- JS adapter now detects `el.innerHTML = <tainted>` (property assignment) as a
+  DOM XSS sink — previously only `innerHTML` inside call expressions was caught.
+
+## [1.0.39] — 2026-09-13
+
+### Added
+
+- **Phase 5 — Framework Intelligence** (`src/frameworks.ts` + `intelligence/frameworks.json`):
+  - Data-driven framework knowledge for 7 frameworks (361 patterns), extensible
+    without code changes: Laravel, WordPress (PHP); Express, Next.js (JS/TS);
+    Django, FastAPI (Python); Spring (Java). Rails (Ruby) deferred until Ruby support.
+  - Each framework defines sources, sinks, sanitizers, auth gates, routing, ORM,
+    and middleware patterns (with CWE tags on sinks).
+  - `detectFramework(code, language)` — heuristic detection via scored signals.
+  - `scanFramework(code, framework)` — framework-aware source/sink/sanitizer/auth hits.
+  - New MCP tools: `list_frameworks`, `detect_framework`, `framework_intel`.
+
 ## [1.0.38] — 2026-09-13
 
 ### Fixed (Phase 4 review)

package/bench/corpus/java-cmd-processbuilder.md

@@ -0,0 +1,8 @@
+- id: java-cmd-processbuilder
+- language: java
+- vulnerable: true
+- sink_type: command_execution
+```java
+String cmd = request.getParameter("cmd");
+new ProcessBuilder(cmd).start();
+```

package/bench/corpus/java-deser-readunshared.md

@@ -0,0 +1,8 @@
+- id: java-deser-readunshared
+- language: java
+- vulnerable: true
+- sink_type: deserialization
+```java
+ObjectInputStream ois = new ObjectInputStream(request.getInputStream());
+ois.readUnshared();
+```

package/bench/corpus/java-sqli-execute.md

@@ -0,0 +1,8 @@
+- id: java-sqli-execute
+- language: java
+- vulnerable: true
+- sink_type: sql_execution
+```java
+String id = request.getParameter("id");
+st.execute("DELETE FROM t WHERE id=" + id);
+```

package/bench/corpus/java-ssrf-httpurl.md

@@ -0,0 +1,8 @@
+- id: java-ssrf-httpurl
+- language: java
+- vulnerable: true
+- sink_type: http_request
+```java
+String url = request.getParameter("url");
+HttpURLConnection c = (HttpURLConnection) new URL(url).openConnection();
+```

package/bench/corpus/java-xss-escape.md

@@ -0,0 +1,8 @@
+- id: java-xss-escape
+- language: java
+- vulnerable: false
+- sink_type: html_render
+```java
+String x = request.getParameter("x");
+response.getWriter().write(HtmlUtils.htmlEscape(x));
+```

package/bench/corpus/java-xss-println.md

@@ -0,0 +1,8 @@
+- id: java-xss-println
+- language: java
+- vulnerable: true
+- sink_type: html_render
+```java
+String x = request.getParameter("x");
+response.getWriter().println(x);
+```

package/bench/corpus/js-cmd-execsync.md

@@ -0,0 +1,8 @@
+- id: js-cmd-execsync
+- language: javascript
+- vulnerable: true
+- sink_type: command_execution
+```javascript
+const c = req.query.cmd;
+execSync("ls " + c);
+```

package/bench/corpus/js-filewrite.md

@@ -0,0 +1,8 @@
+- id: js-filewrite
+- language: javascript
+- vulnerable: true
+- sink_type: file_operations
+```javascript
+const d = req.body.data;
+fs.writeFile("/tmp/x", d);
+```

package/bench/corpus/js-pathtraversal-readsync.md

@@ -0,0 +1,8 @@
+- id: js-pathtraversal-readsync
+- language: javascript
+- vulnerable: true
+- sink_type: path_traversal
+```javascript
+const f = req.query.file;
+fs.readFileSync("/data/" + f);
+```

package/bench/corpus/js-redirect-encodeuri.md

@@ -0,0 +1,8 @@
+- id: js-redirect-encodeuri
+- language: javascript
+- vulnerable: false
+- sink_type: redirect
+```javascript
+const u = req.query.u;
+res.redirect(encodeURIComponent(u));
+```

package/bench/corpus/js-ssrf-axios.md

@@ -0,0 +1,8 @@
+- id: js-ssrf-axios
+- language: javascript
+- vulnerable: true
+- sink_type: http_request
+```javascript
+const u = req.query.url;
+axios.get(u);
+```

package/bench/corpus/js-ssrf-fetch.md

@@ -0,0 +1,8 @@
+- id: js-ssrf-fetch
+- language: javascript
+- vulnerable: true
+- sink_type: http_request
+```javascript
+const u = req.query.url;
+fetch(u);
+```

package/bench/corpus/js-xss-documentwrite.md

@@ -0,0 +1,8 @@
+- id: js-xss-documentwrite
+- language: javascript
+- vulnerable: true
+- sink_type: html_render
+```javascript
+const x = req.query.x;
+document.write(x);
+```

package/bench/corpus/js-xss-innerhtml.md

@@ -0,0 +1,8 @@
+- id: js-xss-innerhtml
+- language: javascript
+- vulnerable: true
+- sink_type: html_render
+```javascript
+const x = req.query.x;
+el.innerHTML = x;
+```

package/bench/corpus/php-cmd-absint.md

@@ -0,0 +1,9 @@
+- id: php-cmd-absint
+- language: php
+- vulnerable: false
+- sink_type: command_execution
+```php
+<?php
+$n = $_GET["n"];
+system("ping -c " . absint($n));
+```

package/bench/corpus/php-cmd-popen.md

@@ -0,0 +1,9 @@
+- id: php-cmd-popen
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+$cmd = $_GET["cmd"];
+popen($cmd, "r");
+```

package/bench/corpus/php-deser-json.md

@@ -0,0 +1,9 @@
+- id: php-deser-json
+- language: php
+- vulnerable: false
+- sink_type: deserialization
+```php
+<?php
+$data = $_COOKIE["data"];
+json_decode($data);
+```

package/bench/corpus/php-include-once.md

@@ -0,0 +1,9 @@
+- id: php-include-once
+- language: php
+- vulnerable: true
+- sink_type: file_inclusion
+```php
+<?php
+$page = $_GET["page"];
+include_once($page . ".php");
+```

package/bench/corpus/php-include-sanitized.md

@@ -0,0 +1,9 @@
+- id: php-include-sanitized
+- language: php
+- vulnerable: false
+- sink_type: file_inclusion
+```php
+<?php
+$f = $_GET["f"];
+include(sanitize_file_name($f));
+```

package/bench/corpus/php-sqli-filterinput.md

@@ -0,0 +1,9 @@
+- id: php-sqli-filterinput
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+$id = filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT);
+$wpdb->query("SELECT * FROM t WHERE id=$id");
+```

package/bench/corpus/php-sqli-getresults.md

@@ -0,0 +1,9 @@
+- id: php-sqli-getresults
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+$id = $_GET["id"];
+$wpdb->get_results("SELECT * FROM t WHERE id=$id");
+```

package/bench/corpus/php-ssrf-wppost.md

@@ -0,0 +1,9 @@
+- id: php-ssrf-wppost
+- language: php
+- vulnerable: true
+- sink_type: http_request
+```php
+<?php
+$url = $_GET["url"];
+wp_remote_post($url, []);
+```

package/bench/corpus/php-xss-escurl.md

@@ -0,0 +1,9 @@
+- id: php-xss-escurl
+- language: php
+- vulnerable: false
+- sink_type: redirect
+```php
+<?php
+$url = $_GET["url"];
+wp_safe_redirect(esc_url($url));
+```

package/bench/corpus/php-xss-print.md

@@ -0,0 +1,9 @@
+- id: php-xss-print
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+$name = $_GET["name"];
+print $name;
+```

package/bench/corpus/php-xss-sanitizetext.md

@@ -0,0 +1,9 @@
+- id: php-xss-sanitizetext
+- language: php
+- vulnerable: false
+- sink_type: html_render
+```php
+<?php
+$v = $_GET["v"];
+echo sanitize_text_field($v);
+```

package/bench/corpus/py-cmd-popen.md

@@ -0,0 +1,9 @@
+- id: py-cmd-popen
+- language: python
+- vulnerable: true
+- sink_type: command_execution
+```python
+import os
+cmd = request.args.get("cmd")
+os.popen(cmd)
+```

package/bench/corpus/py-cmd-shlex.md

@@ -0,0 +1,9 @@
+- id: py-cmd-shlex
+- language: python
+- vulnerable: false
+- sink_type: command_execution
+```python
+import shlex, subprocess
+cmd = request.args.get("cmd")
+subprocess.run(shlex.quote(cmd))
+```

package/bench/corpus/py-deser-yaml.md

@@ -0,0 +1,9 @@
+- id: py-deser-yaml
+- language: python
+- vulnerable: true
+- sink_type: deserialization
+```python
+import yaml
+data = request.get_data()
+yaml.load(data)
+```

package/bench/corpus/py-sqli-executescript.md

@@ -0,0 +1,9 @@
+- id: py-sqli-executescript
+- language: python
+- vulnerable: true
+- sink_type: sql_execution
+```python
+import sqlite3
+id = request.args.get("id")
+cursor.executescript(f"DELETE FROM t WHERE id={id}")
+```

package/bench/corpus/py-ssrf-urllib.md

@@ -0,0 +1,9 @@
+- id: py-ssrf-urllib
+- language: python
+- vulnerable: true
+- sink_type: http_request
+```python
+import urllib.request
+url = request.args.get("url")
+urllib.request.urlopen(url)
+```

package/bench/corpus/py-xss-escape.md

@@ -0,0 +1,8 @@
+- id: py-xss-escape
+- language: python
+- vulnerable: false
+- sink_type: html_render
+```python
+name = request.args.get("name")
+return render_template_string(escape(name))
+```