blitzstrike 1.0.39 → 1.0.41

package/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.41] — 2026-09-13
+
+### Added
+
+- **Phase 6 — Browser Validation** (`src/browser.ts` + MCP tool `browser_validate`):
+  - Playwright-based validation of static-analysis hypotheses (not a scanner —
+    gated, "use only when necessary").
+  - Checks: `dom_xss` (marker-payload execution), `open_redirect` (unexpected
+    redirect), `auth_bypass` (missing auth enforcement), `csrf` (tokenless
+    state-changing form).
+  - Each check returns structured evidence (verdict + final_url + dom/console/
+    page-error signals) suitable for attaching to a finding.
+  - `playwright-core` is an **optional peer dependency**; `browser_validate`
+    degrades to a clear `unavailable` result when it is not installed.
+  - Hermetic browser test suite (`bun run test:browser`, 8 checks) against a
+    local vulnerable server.
+
+## [1.0.40] — 2026-09-13
+
+### Changed (review + spec alignment)
+
+- **Coverage Matrix 2.0 (§57)**: `coverageMatrix()` now also tracks the framework
+  dimension — per-framework sinks/sources/sanitizers/auth counts + CWE set.
+- **Benchmark 100+ (§65)**: corpus grown 70 → **101 fixtures** (70 vulnerable +
+  31 patched), still scoring detection 1.0 / FP 0 / FN 0 / precision 1.0.
+
+### Fixed
+
+- JS adapter now detects `el.innerHTML = <tainted>` (property assignment) as a
+  DOM XSS sink — previously only `innerHTML` inside call expressions was caught.
+
 ## [1.0.39] — 2026-09-13
 
 ### Added

package/bench/corpus/java-cmd-processbuilder.md

@@ -0,0 +1,8 @@
+- id: java-cmd-processbuilder
+- language: java
+- vulnerable: true
+- sink_type: command_execution
+```java
+String cmd = request.getParameter("cmd");
+new ProcessBuilder(cmd).start();
+```

package/bench/corpus/java-deser-readunshared.md

@@ -0,0 +1,8 @@
+- id: java-deser-readunshared
+- language: java
+- vulnerable: true
+- sink_type: deserialization
+```java
+ObjectInputStream ois = new ObjectInputStream(request.getInputStream());
+ois.readUnshared();
+```

package/bench/corpus/java-sqli-execute.md

@@ -0,0 +1,8 @@
+- id: java-sqli-execute
+- language: java
+- vulnerable: true
+- sink_type: sql_execution
+```java
+String id = request.getParameter("id");
+st.execute("DELETE FROM t WHERE id=" + id);
+```

package/bench/corpus/java-ssrf-httpurl.md

@@ -0,0 +1,8 @@
+- id: java-ssrf-httpurl
+- language: java
+- vulnerable: true
+- sink_type: http_request
+```java
+String url = request.getParameter("url");
+HttpURLConnection c = (HttpURLConnection) new URL(url).openConnection();
+```

package/bench/corpus/java-xss-escape.md

@@ -0,0 +1,8 @@
+- id: java-xss-escape
+- language: java
+- vulnerable: false
+- sink_type: html_render
+```java
+String x = request.getParameter("x");
+response.getWriter().write(HtmlUtils.htmlEscape(x));
+```

package/bench/corpus/java-xss-println.md

@@ -0,0 +1,8 @@
+- id: java-xss-println
+- language: java
+- vulnerable: true
+- sink_type: html_render
+```java
+String x = request.getParameter("x");
+response.getWriter().println(x);
+```

package/bench/corpus/js-cmd-execsync.md

@@ -0,0 +1,8 @@
+- id: js-cmd-execsync
+- language: javascript
+- vulnerable: true
+- sink_type: command_execution
+```javascript
+const c = req.query.cmd;
+execSync("ls " + c);
+```

package/bench/corpus/js-filewrite.md

@@ -0,0 +1,8 @@
+- id: js-filewrite
+- language: javascript
+- vulnerable: true
+- sink_type: file_operations
+```javascript
+const d = req.body.data;
+fs.writeFile("/tmp/x", d);
+```

package/bench/corpus/js-pathtraversal-readsync.md

@@ -0,0 +1,8 @@
+- id: js-pathtraversal-readsync
+- language: javascript
+- vulnerable: true
+- sink_type: path_traversal
+```javascript
+const f = req.query.file;
+fs.readFileSync("/data/" + f);
+```

package/bench/corpus/js-redirect-encodeuri.md

@@ -0,0 +1,8 @@
+- id: js-redirect-encodeuri
+- language: javascript
+- vulnerable: false
+- sink_type: redirect
+```javascript
+const u = req.query.u;
+res.redirect(encodeURIComponent(u));
+```

package/bench/corpus/js-ssrf-axios.md

@@ -0,0 +1,8 @@
+- id: js-ssrf-axios
+- language: javascript
+- vulnerable: true
+- sink_type: http_request
+```javascript
+const u = req.query.url;
+axios.get(u);
+```

package/bench/corpus/js-ssrf-fetch.md

@@ -0,0 +1,8 @@
+- id: js-ssrf-fetch
+- language: javascript
+- vulnerable: true
+- sink_type: http_request
+```javascript
+const u = req.query.url;
+fetch(u);
+```

package/bench/corpus/js-xss-documentwrite.md

@@ -0,0 +1,8 @@
+- id: js-xss-documentwrite
+- language: javascript
+- vulnerable: true
+- sink_type: html_render
+```javascript
+const x = req.query.x;
+document.write(x);
+```

package/bench/corpus/js-xss-innerhtml.md

@@ -0,0 +1,8 @@
+- id: js-xss-innerhtml
+- language: javascript
+- vulnerable: true
+- sink_type: html_render
+```javascript
+const x = req.query.x;
+el.innerHTML = x;
+```

package/bench/corpus/php-cmd-absint.md

@@ -0,0 +1,9 @@
+- id: php-cmd-absint
+- language: php
+- vulnerable: false
+- sink_type: command_execution
+```php
+<?php
+$n = $_GET["n"];
+system("ping -c " . absint($n));
+```

package/bench/corpus/php-cmd-popen.md

@@ -0,0 +1,9 @@
+- id: php-cmd-popen
+- language: php
+- vulnerable: true
+- sink_type: command_execution
+```php
+<?php
+$cmd = $_GET["cmd"];
+popen($cmd, "r");
+```

package/bench/corpus/php-deser-json.md

@@ -0,0 +1,9 @@
+- id: php-deser-json
+- language: php
+- vulnerable: false
+- sink_type: deserialization
+```php
+<?php
+$data = $_COOKIE["data"];
+json_decode($data);
+```

package/bench/corpus/php-include-once.md

@@ -0,0 +1,9 @@
+- id: php-include-once
+- language: php
+- vulnerable: true
+- sink_type: file_inclusion
+```php
+<?php
+$page = $_GET["page"];
+include_once($page . ".php");
+```

package/bench/corpus/php-include-sanitized.md

@@ -0,0 +1,9 @@
+- id: php-include-sanitized
+- language: php
+- vulnerable: false
+- sink_type: file_inclusion
+```php
+<?php
+$f = $_GET["f"];
+include(sanitize_file_name($f));
+```

package/bench/corpus/php-sqli-filterinput.md

@@ -0,0 +1,9 @@
+- id: php-sqli-filterinput
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+$id = filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT);
+$wpdb->query("SELECT * FROM t WHERE id=$id");
+```

package/bench/corpus/php-sqli-getresults.md

@@ -0,0 +1,9 @@
+- id: php-sqli-getresults
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+$id = $_GET["id"];
+$wpdb->get_results("SELECT * FROM t WHERE id=$id");
+```

package/bench/corpus/php-ssrf-wppost.md

@@ -0,0 +1,9 @@
+- id: php-ssrf-wppost
+- language: php
+- vulnerable: true
+- sink_type: http_request
+```php
+<?php
+$url = $_GET["url"];
+wp_remote_post($url, []);
+```

package/bench/corpus/php-xss-escurl.md

@@ -0,0 +1,9 @@
+- id: php-xss-escurl
+- language: php
+- vulnerable: false
+- sink_type: redirect
+```php
+<?php
+$url = $_GET["url"];
+wp_safe_redirect(esc_url($url));
+```

package/bench/corpus/php-xss-print.md

@@ -0,0 +1,9 @@
+- id: php-xss-print
+- language: php
+- vulnerable: true
+- sink_type: html_render
+```php
+<?php
+$name = $_GET["name"];
+print $name;
+```

package/bench/corpus/php-xss-sanitizetext.md

@@ -0,0 +1,9 @@
+- id: php-xss-sanitizetext
+- language: php
+- vulnerable: false
+- sink_type: html_render
+```php
+<?php
+$v = $_GET["v"];
+echo sanitize_text_field($v);
+```

package/bench/corpus/py-cmd-popen.md

@@ -0,0 +1,9 @@
+- id: py-cmd-popen
+- language: python
+- vulnerable: true
+- sink_type: command_execution
+```python
+import os
+cmd = request.args.get("cmd")
+os.popen(cmd)
+```

package/bench/corpus/py-cmd-shlex.md

@@ -0,0 +1,9 @@
+- id: py-cmd-shlex
+- language: python
+- vulnerable: false
+- sink_type: command_execution
+```python
+import shlex, subprocess
+cmd = request.args.get("cmd")
+subprocess.run(shlex.quote(cmd))
+```

package/bench/corpus/py-deser-yaml.md

@@ -0,0 +1,9 @@
+- id: py-deser-yaml
+- language: python
+- vulnerable: true
+- sink_type: deserialization
+```python
+import yaml
+data = request.get_data()
+yaml.load(data)
+```

package/bench/corpus/py-sqli-executescript.md

@@ -0,0 +1,9 @@
+- id: py-sqli-executescript
+- language: python
+- vulnerable: true
+- sink_type: sql_execution
+```python
+import sqlite3
+id = request.args.get("id")
+cursor.executescript(f"DELETE FROM t WHERE id={id}")
+```

package/bench/corpus/py-ssrf-urllib.md

@@ -0,0 +1,9 @@
+- id: py-ssrf-urllib
+- language: python
+- vulnerable: true
+- sink_type: http_request
+```python
+import urllib.request
+url = request.args.get("url")
+urllib.request.urlopen(url)
+```

package/bench/corpus/py-xss-escape.md

@@ -0,0 +1,8 @@
+- id: py-xss-escape
+- language: python
+- vulnerable: false
+- sink_type: html_render
+```python
+name = request.args.get("name")
+return render_template_string(escape(name))
+```

package/dist/index.js

@@ -50492,13 +50492,23 @@ var jsAdapter = {
             rhsVars.push(c.name);
         assigns.push({ target: name, sources: rhsVars, line: n.loc?.start?.line ?? 0 });
       }
-      if (n.type === "AssignmentExpression" && n.left?.type === "Identifier") {
-        const name = n.left.name;
-        const rhsVars = [];
-        for (const c of jsWalk(n.right, []))
-          if (c.type === "Identifier" && c.name)
-            rhsVars.push(c.name);
-        assigns.push({ target: name, sources: rhsVars, line: n.loc?.start?.line ?? 0 });
+      if (n.type === "AssignmentExpression") {
+        if (n.left?.type === "MemberExpression" && n.left.property?.name === "innerHTML") {
+          const rhsVars = [];
+          for (const c of jsWalk(n.right, []))
+            if (c.type === "Identifier" && c.name)
+              rhsVars.push(c.name);
+          for (const v of rhsVars)
+            sinks.push({ variable: v, kind: "html_render", line: n.loc?.start?.line ?? 0, cwe: "CWE-79" });
+        }
+        if (n.left?.type === "Identifier") {
+          const name = n.left.name;
+          const rhsVars = [];
+          for (const c of jsWalk(n.right, []))
+            if (c.type === "Identifier" && c.name)
+              rhsVars.push(c.name);
+          assigns.push({ target: name, sources: rhsVars, line: n.loc?.start?.line ?? 0 });
+        }
       }
       if (n.type === "CallExpression") {
         const calleeText = srcText(n.callee);
@@ -51030,6 +51040,162 @@ function scanFramework(code, frameworkId) {
   };
 }
 
+// src/browser.ts
+var chromiumCache = null;
+async function ensureChromium() {
+  if (chromiumCache)
+    return chromiumCache;
+  try {
+    chromiumCache = await import("playwright-core");
+    return chromiumCache;
+  } catch {
+    return null;
+  }
+}
+function unavailable(check, target, reason) {
+  return {
+    check,
+    target: redactSecrets(target),
+    verdict: "unavailable",
+    detail: reason,
+    evidence: { console_errors: [], page_errors: [] }
+  };
+}
+function errorEvidence(check, target, e) {
+  return {
+    check,
+    target: redactSecrets(target),
+    verdict: "error",
+    detail: e instanceof Error ? e.message : String(e),
+    evidence: { console_errors: [], page_errors: [] }
+  };
+}
+async function validateDomXss(target, payload = '<img src=x onerror="window.__blitz_xss__=true">') {
+  const chr = await ensureChromium();
+  if (!chr)
+    return unavailable("dom_xss", target, "playwright-core not installed (optional peer dependency)");
+  const browser = await chr.chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    const consoleErrors = [];
+    const pageErrors = [];
+    page.on("console", (m) => {
+      if (m.type() === "error")
+        consoleErrors.push(m.text());
+    });
+    page.on("pageerror", (e) => pageErrors.push(String(e)));
+    const url = target.includes("{{payload}}") ? target.replace("{{payload}}", encodeURIComponent(payload)) : target;
+    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 15000 });
+    await page.waitForTimeout(600);
+    const marker = await page.evaluate(() => window.__blitz_xss__ === true);
+    return {
+      check: "dom_xss",
+      target: redactSecrets(target),
+      verdict: marker ? "confirmed" : "not_confirmed",
+      detail: marker ? "payload executed (marker set)" : "payload did not execute (no marker)",
+      evidence: { final_url: page.url(), dom_marker: marker, console_errors: consoleErrors, page_errors: pageErrors }
+    };
+  } catch (e) {
+    return errorEvidence("dom_xss", target, e);
+  } finally {
+    await browser.close();
+  }
+}
+async function validateOpenRedirect(target, payload) {
+  const chr = await ensureChromium();
+  if (!chr)
+    return unavailable("open_redirect", target, "playwright-core not installed (optional peer dependency)");
+  const browser = await chr.chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    const url = target.includes("{{payload}}") ? target.replace("{{payload}}", encodeURIComponent(payload)) : target;
+    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 15000 });
+    await page.waitForTimeout(400);
+    const finalUrl = page.url();
+    const redirected = finalUrl !== url && finalUrl.includes(payload);
+    return {
+      check: "open_redirect",
+      target: redactSecrets(target),
+      verdict: redirected ? "confirmed" : "not_confirmed",
+      detail: redirected ? `browser redirected to ${finalUrl}` : `no redirect to attacker URL (final: ${finalUrl})`,
+      evidence: { final_url: finalUrl, console_errors: [], page_errors: [] }
+    };
+  } catch (e) {
+    return errorEvidence("open_redirect", target, e);
+  } finally {
+    await browser.close();
+  }
+}
+async function validateAuthBypass(target) {
+  const chr = await ensureChromium();
+  if (!chr)
+    return unavailable("auth_bypass", target, "playwright-core not installed (optional peer dependency)");
+  const browser = await chr.chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    const resp = await page.goto(target, { waitUntil: "domcontentloaded", timeout: 15000 });
+    const status = resp?.status() ?? 0;
+    const finalUrl = page.url();
+    const enforced = status === 401 || status === 403 || /login|signin|auth/.test(finalUrl);
+    return {
+      check: "auth_bypass",
+      target: redactSecrets(target),
+      verdict: enforced ? "not_confirmed" : "confirmed",
+      detail: enforced ? `auth enforced (status ${status}, final ${finalUrl})` : `no auth enforcement observed (status ${status}, final ${finalUrl})`,
+      evidence: { final_url: finalUrl, status, console_errors: [], page_errors: [] }
+    };
+  } catch (e) {
+    return errorEvidence("auth_bypass", target, e);
+  } finally {
+    await browser.close();
+  }
+}
+async function validateCsrf(target) {
+  const chr = await ensureChromium();
+  if (!chr)
+    return unavailable("csrf", target, "playwright-core not installed (optional peer dependency)");
+  const browser = await chr.chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    await page.goto(target, { waitUntil: "domcontentloaded", timeout: 15000 });
+    const result = await page.evaluate(() => {
+      const forms = Array.from(document.querySelectorAll("form"));
+      const stateChanging = forms.filter((f) => /post/i.test(f.method) || f.method === "");
+      if (stateChanging.length === 0)
+        return { token: true, count: 0 };
+      for (const f of stateChanging) {
+        const token = f.querySelector('input[name*="csrf"], input[name*="token"], input[name*="_token"], input[name*="nonce"]');
+        if (!token)
+          return { token: false, count: stateChanging.length };
+      }
+      return { token: true, count: stateChanging.length };
+    });
+    return {
+      check: "csrf",
+      target: redactSecrets(target),
+      verdict: result.token ? "not_confirmed" : "confirmed",
+      detail: result.token ? `CSRF token present (${result.count} form(s))` : `state-changing form missing CSRF token (${result.count} form(s))`,
+      evidence: { csrf_token_present: result.token, forms_count: result.count, console_errors: [], page_errors: [] }
+    };
+  } catch (e) {
+    return errorEvidence("csrf", target, e);
+  } finally {
+    await browser.close();
+  }
+}
+async function browserValidate(check, target, payload) {
+  switch (check) {
+    case "dom_xss":
+      return validateDomXss(target, payload);
+    case "open_redirect":
+      return validateOpenRedirect(target, payload ?? "https://attacker.example/");
+    case "auth_bypass":
+      return validateAuthBypass(target);
+    case "csrf":
+      return validateCsrf(target);
+  }
+}
+
 // src/guidance.ts
 var SINK_DIRECTIVES = {
   sql_execution: "Validate the SQL injection live with strike_verify (use a unique MARKER and a NEGATIVE CONTROL that stays inert), or read_tool_manual for sqlmap. Only a reflected marker + inert control = confirmed.",
@@ -52039,6 +52205,19 @@ function coverageMatrix() {
     const covered = langs.map((l) => l.language).filter((lang) => SINK_BY_LANG[lang]?.[sink] === true);
     return { sink, languages: covered };
   });
+  const frameworkCoverage = listFrameworks().map(({ id, language }) => {
+    const p = frameworkProfile(id);
+    const cwe = p ? [...new Set(p.sinks.map((s) => s.cwe).filter((c) => !!c))].sort() : [];
+    return {
+      framework: id,
+      language,
+      sinks: p?.sinks.length ?? 0,
+      sources: p?.sources.length ?? 0,
+      sanitizers: p?.sanitizers.length ?? 0,
+      auth: p?.auth.length ?? 0,
+      cwe
+    };
+  });
   let coveredPairs = 0;
   for (const lang of langs) {
     for (const sink of SINK_CLASSES) {
@@ -52050,11 +52229,13 @@ function coverageMatrix() {
   return {
     languages: langs,
     sink_coverage: sinkCoverage,
+    framework_coverage: frameworkCoverage,
     counts: {
       languages: langs.length,
       sink_classes: SINK_CLASSES.length,
       covered_pairs: coveredPairs,
-      total_pairs: totalPairs
+      total_pairs: totalPairs,
+      frameworks: frameworkCoverage.length
     },
     coverage_ratio: Number((coveredPairs / totalPairs).toFixed(3))
   };
@@ -52818,6 +52999,18 @@ function createServer() {
       out.scan = scanFramework(code, framework);
     return { content: [{ type: "text", text: JSON.stringify(out) }] };
   });
+  server.registerTool("browser_validate", {
+    title: "Browser validation (Playwright)",
+    description: "PHASE 6: validate a static-analysis HYPOTHESIS by driving a real headless Chromium. Checks: dom_xss, open_redirect, auth_bypass, csrf. Use only when necessary — to confirm a hypothesis with browser evidence, not as a first-pass scan. Requires playwright-core (optional peer dependency).",
+    inputSchema: {
+      check: _enum(["dom_xss", "open_redirect", "auth_bypass", "csrf"]).describe("Validation check to run"),
+      target: string2().describe("Target URL (use {{payload}} placeholder for dom_xss/open_redirect injection)"),
+      payload: string2().optional().describe("Payload to inject (defaults to an XSS marker for dom_xss)")
+    }
+  }, async ({ check, target, payload }) => {
+    const result = await browserValidate(check, target, payload);
+    return { content: [{ type: "text", text: JSON.stringify(result) }] };
+  });
   server.registerTool("taint_tree", {
     title: "Whole-tree taint scan",
     description: "EAGLE-EYE: run inter-procedural taint analysis across an entire source tree.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.39",
+  "version": "1.0.41",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {
@@ -25,12 +25,13 @@
     "tools-catalog.json"
   ],
   "scripts": {
-    "build": "bun build src/index.ts --outdir dist --target node --format esm",
+    "build": "bun build src/index.ts --outdir dist --target node --format esm --external playwright-core",
     "typecheck": "tsc --noEmit",
     "serve": "bun run src/index.ts serve",
     "doctor": "bun run src/index.ts doctor",
     "compile": "bun build src/index.ts --compile --outfile dist/blitzstrike",
     "test": "bun run test/verify.ts",
+    "test:browser": "bun run test/browser-verify.ts",
     "prepublishOnly": "bun run typecheck && bun run build",
     "bench": "bun run test/verify.ts"
   },
@@ -74,6 +75,15 @@
   },
   "devDependencies": {
     "@types/node": "^22.20.2",
+    "playwright-core": "1.61.0",
     "typescript": "^5.5.0"
+  },
+  "peerDependencies": {
+    "playwright-core": ">=1.61.0"
+  },
+  "peerDependenciesMeta": {
+    "playwright-core": {
+      "optional": true
+    }
   }
 }