blitzstrike 1.0.39 → 1.0.40

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.40] — 2026-09-13
+
+### Changed (review + spec alignment)
+
+- **Coverage Matrix 2.0 (§57)**: `coverageMatrix()` now also tracks the framework
+  dimension — per-framework sinks/sources/sanitizers/auth counts + CWE set.
+- **Benchmark 100+ (§65)**: corpus grown 70 → **101 fixtures** (70 vulnerable +
+  31 patched), still scoring detection 1.0 / FP 0 / FN 0 / precision 1.0.
+
+### Fixed
+
+- JS adapter now detects `el.innerHTML = <tainted>` (property assignment) as a
+  DOM XSS sink — previously only `innerHTML` inside call expressions was caught.
+
 ## [1.0.39] — 2026-09-13
 
 ### Added

package/bench/corpus/java-cmd-processbuilder.md

@@ -0,0 +1,8 @@
+- id: java-cmd-processbuilder
+- language: java
+- vulnerable: true
+- sink_type: command_execution
+```java
+String cmd = request.getParameter("cmd");
+new ProcessBuilder(cmd).start();
+```

package/bench/corpus/java-deser-readunshared.md

@@ -0,0 +1,8 @@
+- id: java-deser-readunshared
+- language: java
+- vulnerable: true
+- sink_type: deserialization
+```java
+ObjectInputStream ois = new ObjectInputStream(request.getInputStream());
+ois.readUnshared();
+```

package/bench/corpus/java-sqli-execute.md

@@ -0,0 +1,8 @@
+- id: java-sqli-execute
+- language: java
+- vulnerable: true
+- sink_type: sql_execution
+```java
+String id = request.getParameter("id");
+st.execute("DELETE FROM t WHERE id=" + id);
+```

package/bench/corpus/java-ssrf-httpurl.md

@@ -0,0 +1,8 @@
+- id: java-ssrf-httpurl
+- language: java
+- vulnerable: true
+- sink_type: http_request
+```java
+String url = request.getParameter("url");
+HttpURLConnection c = (HttpURLConnection) new URL(url).openConnection();
+```

package/bench/corpus/java-xss-escape.md

@@ -0,0 +1,8 @@
+- id: java-xss-escape
+- language: java
+- vulnerable: false
+- sink_type: html_render
+```java
+String x = request.getParameter("x");
+response.getWriter().write(HtmlUtils.htmlEscape(x));
+```

package/bench/corpus/java-xss-println.md

@@ -0,0 +1,8 @@
+- id: java-xss-println
+- language: java
+- vulnerable: true
+- sink_type: html_render
+```java
+String x = request.getParameter("x");
+response.getWriter().println(x);
+```

package/bench/corpus/js-cmd-execsync.md

@@ -0,0 +1,8 @@
+- id: js-cmd-execsync
+- language: javascript
+- vulnerable: true
+- sink_type: command_execution
+```javascript
+const c = req.query.cmd;
+execSync("ls " + c);
+```

package/bench/corpus/js-filewrite.md

@@ -0,0 +1,8 @@
+- id: js-filewrite
+- language: javascript
+- vulnerable: true
+- sink_type: file_operations
+```javascript
+const d = req.body.data;
+fs.writeFile("/tmp/x", d);
+```

package/bench/corpus/js-pathtraversal-readsync.md

@@ -0,0 +1,8 @@
+- id: js-pathtraversal-readsync
+- language: javascript
+- vulnerable: true
+- sink_type: path_traversal
+```javascript
+const f = req.query.file;
+fs.readFileSync("/data/" + f);
+```

package/bench/corpus/js-redirect-encodeuri.md

@@ -0,0 +1,8 @@
+- id: js-redirect-encodeuri
+- language: javascript
+- vulnerable: false
+- sink_type: redirect
+```javascript
+const u = req.query.u;
+res.redirect(encodeURIComponent(u));
+```

package/bench/corpus/js-ssrf-axios.md

@@ -0,0 +1,8 @@
+- id: js-ssrf-axios
+- language: javascript
+- vulnerable: true
+- sink_type: http_request
+```javascript
+const u = req.query.url;
+axios.get(u);
+```

package/bench/corpus/js-ssrf-fetch.md

@@ -0,0 +1,8 @@
+- id: js-ssrf-fetch
+- language: javascript
+- vulnerable: true
+- sink_type: http_request
+```javascript
+const u = req.query.url;
+fetch(u);
+```

package/bench/corpus/js-xss-documentwrite.md

@@ -0,0 +1,8 @@
+- id: js-xss-documentwrite
+- language: javascript
+- vulnerable: true
+- sink_type: html_render
+```javascript
+const x = req.query.x;
+document.write(x);
+```

package/bench/corpus/js-xss-innerhtml.md

@@ -0,0 +1,8 @@
+- id: js-xss-innerhtml
+- language: javascript
+- vulnerable: true
+- sink_type: html_render
+```javascript
+const x = req.query.x;
+el.innerHTML = x;
+```

package/bench/corpus/php-cmd-absint.md

@@ -0,0 +1,9 @@
+- id: php-cmd-absint
+- language: php
+- vulnerable: false
+- sink_type: command_execution
+```php
+<?php
+$n = $_GET["n"];
+system("ping -c " . absint($n));
+```

package/bench/corpus/php-cmd-popen.md

@@ -0,0 +1,9 @@
+- id: php-cmd-popen
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+$cmd = $_GET["cmd"];
+popen($cmd, "r");
+```

package/bench/corpus/php-deser-json.md

@@ -0,0 +1,9 @@
+- id: php-deser-json
+- language: php
+- vulnerable: false
+- sink_type: deserialization
+```php
+<?php
+$data = $_COOKIE["data"];
+json_decode($data);
+```

package/bench/corpus/php-include-once.md

@@ -0,0 +1,9 @@
+- id: php-include-once
+- language: php
+- vulnerable: true
+- sink_type: file_inclusion
+```php
+<?php
+$page = $_GET["page"];
+include_once($page . ".php");
+```

package/bench/corpus/php-include-sanitized.md

@@ -0,0 +1,9 @@
+- id: php-include-sanitized
+- language: php
+- vulnerable: false
+- sink_type: file_inclusion
+```php
+<?php
+$f = $_GET["f"];
+include(sanitize_file_name($f));
+```

package/bench/corpus/php-sqli-filterinput.md

@@ -0,0 +1,9 @@
+- id: php-sqli-filterinput
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+$id = filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT);
+$wpdb->query("SELECT * FROM t WHERE id=$id");
+```

package/bench/corpus/php-sqli-getresults.md

@@ -0,0 +1,9 @@
+- id: php-sqli-getresults
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+$id = $_GET["id"];
+$wpdb->get_results("SELECT * FROM t WHERE id=$id");
+```

package/bench/corpus/php-ssrf-wppost.md

@@ -0,0 +1,9 @@
+- id: php-ssrf-wppost
+- language: php
+- vulnerable: true
+- sink_type: http_request
+```php
+<?php
+$url = $_GET["url"];
+wp_remote_post($url, []);
+```

package/bench/corpus/php-xss-escurl.md

@@ -0,0 +1,9 @@
+- id: php-xss-escurl
+- language: php
+- vulnerable: false
+- sink_type: redirect
+```php
+<?php
+$url = $_GET["url"];
+wp_safe_redirect(esc_url($url));
+```

package/bench/corpus/php-xss-print.md

@@ -0,0 +1,9 @@
+- id: php-xss-print
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+$name = $_GET["name"];
+print $name;
+```

package/bench/corpus/php-xss-sanitizetext.md

@@ -0,0 +1,9 @@
+- id: php-xss-sanitizetext
+- language: php
+- vulnerable: false
+- sink_type: html_render
+```php
+<?php
+$v = $_GET["v"];
+echo sanitize_text_field($v);
+```

package/bench/corpus/py-cmd-popen.md

@@ -0,0 +1,9 @@
+- id: py-cmd-popen
+- language: python
+- vulnerable: true
+- sink_type: command_execution
+```python
+import os
+cmd = request.args.get("cmd")
+os.popen(cmd)
+```

package/bench/corpus/py-cmd-shlex.md

@@ -0,0 +1,9 @@
+- id: py-cmd-shlex
+- language: python
+- vulnerable: false
+- sink_type: command_execution
+```python
+import shlex, subprocess
+cmd = request.args.get("cmd")
+subprocess.run(shlex.quote(cmd))
+```

package/bench/corpus/py-deser-yaml.md

@@ -0,0 +1,9 @@
+- id: py-deser-yaml
+- language: python
+- vulnerable: true
+- sink_type: deserialization
+```python
+import yaml
+data = request.get_data()
+yaml.load(data)
+```

package/bench/corpus/py-sqli-executescript.md

@@ -0,0 +1,9 @@
+- id: py-sqli-executescript
+- language: python
+- vulnerable: true
+- sink_type: sql_execution
+```python
+import sqlite3
+id = request.args.get("id")
+cursor.executescript(f"DELETE FROM t WHERE id={id}")
+```

package/bench/corpus/py-ssrf-urllib.md

@@ -0,0 +1,9 @@
+- id: py-ssrf-urllib
+- language: python
+- vulnerable: true
+- sink_type: http_request
+```python
+import urllib.request
+url = request.args.get("url")
+urllib.request.urlopen(url)
+```

package/bench/corpus/py-xss-escape.md

@@ -0,0 +1,8 @@
+- id: py-xss-escape
+- language: python
+- vulnerable: false
+- sink_type: html_render
+```python
+name = request.args.get("name")
+return render_template_string(escape(name))
+```

package/dist/index.js

@@ -50492,13 +50492,23 @@ var jsAdapter = {
             rhsVars.push(c.name);
         assigns.push({ target: name, sources: rhsVars, line: n.loc?.start?.line ?? 0 });
       }
-      if (n.type === "AssignmentExpression" && n.left?.type === "Identifier") {
-        const name = n.left.name;
-        const rhsVars = [];
-        for (const c of jsWalk(n.right, []))
-          if (c.type === "Identifier" && c.name)
-            rhsVars.push(c.name);
-        assigns.push({ target: name, sources: rhsVars, line: n.loc?.start?.line ?? 0 });
+      if (n.type === "AssignmentExpression") {
+        if (n.left?.type === "MemberExpression" && n.left.property?.name === "innerHTML") {
+          const rhsVars = [];
+          for (const c of jsWalk(n.right, []))
+            if (c.type === "Identifier" && c.name)
+              rhsVars.push(c.name);
+          for (const v of rhsVars)
+            sinks.push({ variable: v, kind: "html_render", line: n.loc?.start?.line ?? 0, cwe: "CWE-79" });
+        }
+        if (n.left?.type === "Identifier") {
+          const name = n.left.name;
+          const rhsVars = [];
+          for (const c of jsWalk(n.right, []))
+            if (c.type === "Identifier" && c.name)
+              rhsVars.push(c.name);
+          assigns.push({ target: name, sources: rhsVars, line: n.loc?.start?.line ?? 0 });
+        }
       }
       if (n.type === "CallExpression") {
         const calleeText = srcText(n.callee);
@@ -52039,6 +52049,19 @@ function coverageMatrix() {
     const covered = langs.map((l) => l.language).filter((lang) => SINK_BY_LANG[lang]?.[sink] === true);
     return { sink, languages: covered };
   });
+  const frameworkCoverage = listFrameworks().map(({ id, language }) => {
+    const p = frameworkProfile(id);
+    const cwe = p ? [...new Set(p.sinks.map((s) => s.cwe).filter((c) => !!c))].sort() : [];
+    return {
+      framework: id,
+      language,
+      sinks: p?.sinks.length ?? 0,
+      sources: p?.sources.length ?? 0,
+      sanitizers: p?.sanitizers.length ?? 0,
+      auth: p?.auth.length ?? 0,
+      cwe
+    };
+  });
   let coveredPairs = 0;
   for (const lang of langs) {
     for (const sink of SINK_CLASSES) {
@@ -52050,11 +52073,13 @@ function coverageMatrix() {
   return {
     languages: langs,
     sink_coverage: sinkCoverage,
+    framework_coverage: frameworkCoverage,
     counts: {
       languages: langs.length,
       sink_classes: SINK_CLASSES.length,
       covered_pairs: coveredPairs,
-      total_pairs: totalPairs
+      total_pairs: totalPairs,
+      frameworks: frameworkCoverage.length
     },
     coverage_ratio: Number((coveredPairs / totalPairs).toFixed(3))
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.39",
+  "version": "1.0.40",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {