blitzstrike 1.0.40 → 1.0.41

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.41] — 2026-09-13
+
+### Added
+
+- **Phase 6 — Browser Validation** (`src/browser.ts` + MCP tool `browser_validate`):
+  - Playwright-based validation of static-analysis hypotheses (not a scanner —
+    gated, "use only when necessary").
+  - Checks: `dom_xss` (marker-payload execution), `open_redirect` (unexpected
+    redirect), `auth_bypass` (missing auth enforcement), `csrf` (tokenless
+    state-changing form).
+  - Each check returns structured evidence (verdict + final_url + dom/console/
+    page-error signals) suitable for attaching to a finding.
+  - `playwright-core` is an **optional peer dependency**; `browser_validate`
+    degrades to a clear `unavailable` result when it is not installed.
+  - Hermetic browser test suite (`bun run test:browser`, 8 checks) against a
+    local vulnerable server.
+
 ## [1.0.40] — 2026-09-13
 
 ### Changed (review + spec alignment)

package/dist/index.js

@@ -51040,6 +51040,162 @@ function scanFramework(code, frameworkId) {
   };
 }
 
+// src/browser.ts
+var chromiumCache = null;
+async function ensureChromium() {
+  if (chromiumCache)
+    return chromiumCache;
+  try {
+    chromiumCache = await import("playwright-core");
+    return chromiumCache;
+  } catch {
+    return null;
+  }
+}
+function unavailable(check, target, reason) {
+  return {
+    check,
+    target: redactSecrets(target),
+    verdict: "unavailable",
+    detail: reason,
+    evidence: { console_errors: [], page_errors: [] }
+  };
+}
+function errorEvidence(check, target, e) {
+  return {
+    check,
+    target: redactSecrets(target),
+    verdict: "error",
+    detail: e instanceof Error ? e.message : String(e),
+    evidence: { console_errors: [], page_errors: [] }
+  };
+}
+async function validateDomXss(target, payload = '<img src=x onerror="window.__blitz_xss__=true">') {
+  const chr = await ensureChromium();
+  if (!chr)
+    return unavailable("dom_xss", target, "playwright-core not installed (optional peer dependency)");
+  const browser = await chr.chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    const consoleErrors = [];
+    const pageErrors = [];
+    page.on("console", (m) => {
+      if (m.type() === "error")
+        consoleErrors.push(m.text());
+    });
+    page.on("pageerror", (e) => pageErrors.push(String(e)));
+    const url = target.includes("{{payload}}") ? target.replace("{{payload}}", encodeURIComponent(payload)) : target;
+    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 15000 });
+    await page.waitForTimeout(600);
+    const marker = await page.evaluate(() => window.__blitz_xss__ === true);
+    return {
+      check: "dom_xss",
+      target: redactSecrets(target),
+      verdict: marker ? "confirmed" : "not_confirmed",
+      detail: marker ? "payload executed (marker set)" : "payload did not execute (no marker)",
+      evidence: { final_url: page.url(), dom_marker: marker, console_errors: consoleErrors, page_errors: pageErrors }
+    };
+  } catch (e) {
+    return errorEvidence("dom_xss", target, e);
+  } finally {
+    await browser.close();
+  }
+}
+async function validateOpenRedirect(target, payload) {
+  const chr = await ensureChromium();
+  if (!chr)
+    return unavailable("open_redirect", target, "playwright-core not installed (optional peer dependency)");
+  const browser = await chr.chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    const url = target.includes("{{payload}}") ? target.replace("{{payload}}", encodeURIComponent(payload)) : target;
+    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 15000 });
+    await page.waitForTimeout(400);
+    const finalUrl = page.url();
+    const redirected = finalUrl !== url && finalUrl.includes(payload);
+    return {
+      check: "open_redirect",
+      target: redactSecrets(target),
+      verdict: redirected ? "confirmed" : "not_confirmed",
+      detail: redirected ? `browser redirected to ${finalUrl}` : `no redirect to attacker URL (final: ${finalUrl})`,
+      evidence: { final_url: finalUrl, console_errors: [], page_errors: [] }
+    };
+  } catch (e) {
+    return errorEvidence("open_redirect", target, e);
+  } finally {
+    await browser.close();
+  }
+}
+async function validateAuthBypass(target) {
+  const chr = await ensureChromium();
+  if (!chr)
+    return unavailable("auth_bypass", target, "playwright-core not installed (optional peer dependency)");
+  const browser = await chr.chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    const resp = await page.goto(target, { waitUntil: "domcontentloaded", timeout: 15000 });
+    const status = resp?.status() ?? 0;
+    const finalUrl = page.url();
+    const enforced = status === 401 || status === 403 || /login|signin|auth/.test(finalUrl);
+    return {
+      check: "auth_bypass",
+      target: redactSecrets(target),
+      verdict: enforced ? "not_confirmed" : "confirmed",
+      detail: enforced ? `auth enforced (status ${status}, final ${finalUrl})` : `no auth enforcement observed (status ${status}, final ${finalUrl})`,
+      evidence: { final_url: finalUrl, status, console_errors: [], page_errors: [] }
+    };
+  } catch (e) {
+    return errorEvidence("auth_bypass", target, e);
+  } finally {
+    await browser.close();
+  }
+}
+async function validateCsrf(target) {
+  const chr = await ensureChromium();
+  if (!chr)
+    return unavailable("csrf", target, "playwright-core not installed (optional peer dependency)");
+  const browser = await chr.chromium.launch({ headless: true });
+  try {
+    const page = await browser.newPage();
+    await page.goto(target, { waitUntil: "domcontentloaded", timeout: 15000 });
+    const result = await page.evaluate(() => {
+      const forms = Array.from(document.querySelectorAll("form"));
+      const stateChanging = forms.filter((f) => /post/i.test(f.method) || f.method === "");
+      if (stateChanging.length === 0)
+        return { token: true, count: 0 };
+      for (const f of stateChanging) {
+        const token = f.querySelector('input[name*="csrf"], input[name*="token"], input[name*="_token"], input[name*="nonce"]');
+        if (!token)
+          return { token: false, count: stateChanging.length };
+      }
+      return { token: true, count: stateChanging.length };
+    });
+    return {
+      check: "csrf",
+      target: redactSecrets(target),
+      verdict: result.token ? "not_confirmed" : "confirmed",
+      detail: result.token ? `CSRF token present (${result.count} form(s))` : `state-changing form missing CSRF token (${result.count} form(s))`,
+      evidence: { csrf_token_present: result.token, forms_count: result.count, console_errors: [], page_errors: [] }
+    };
+  } catch (e) {
+    return errorEvidence("csrf", target, e);
+  } finally {
+    await browser.close();
+  }
+}
+async function browserValidate(check, target, payload) {
+  switch (check) {
+    case "dom_xss":
+      return validateDomXss(target, payload);
+    case "open_redirect":
+      return validateOpenRedirect(target, payload ?? "https://attacker.example/");
+    case "auth_bypass":
+      return validateAuthBypass(target);
+    case "csrf":
+      return validateCsrf(target);
+  }
+}
+
 // src/guidance.ts
 var SINK_DIRECTIVES = {
   sql_execution: "Validate the SQL injection live with strike_verify (use a unique MARKER and a NEGATIVE CONTROL that stays inert), or read_tool_manual for sqlmap. Only a reflected marker + inert control = confirmed.",
@@ -52843,6 +52999,18 @@ function createServer() {
       out.scan = scanFramework(code, framework);
     return { content: [{ type: "text", text: JSON.stringify(out) }] };
   });
+  server.registerTool("browser_validate", {
+    title: "Browser validation (Playwright)",
+    description: "PHASE 6: validate a static-analysis HYPOTHESIS by driving a real headless Chromium. Checks: dom_xss, open_redirect, auth_bypass, csrf. Use only when necessary — to confirm a hypothesis with browser evidence, not as a first-pass scan. Requires playwright-core (optional peer dependency).",
+    inputSchema: {
+      check: _enum(["dom_xss", "open_redirect", "auth_bypass", "csrf"]).describe("Validation check to run"),
+      target: string2().describe("Target URL (use {{payload}} placeholder for dom_xss/open_redirect injection)"),
+      payload: string2().optional().describe("Payload to inject (defaults to an XSS marker for dom_xss)")
+    }
+  }, async ({ check, target, payload }) => {
+    const result = await browserValidate(check, target, payload);
+    return { content: [{ type: "text", text: JSON.stringify(result) }] };
+  });
   server.registerTool("taint_tree", {
     title: "Whole-tree taint scan",
     description: "EAGLE-EYE: run inter-procedural taint analysis across an entire source tree.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.40",
+  "version": "1.0.41",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {
@@ -25,12 +25,13 @@
     "tools-catalog.json"
   ],
   "scripts": {
-    "build": "bun build src/index.ts --outdir dist --target node --format esm",
+    "build": "bun build src/index.ts --outdir dist --target node --format esm --external playwright-core",
     "typecheck": "tsc --noEmit",
     "serve": "bun run src/index.ts serve",
     "doctor": "bun run src/index.ts doctor",
     "compile": "bun build src/index.ts --compile --outfile dist/blitzstrike",
     "test": "bun run test/verify.ts",
+    "test:browser": "bun run test/browser-verify.ts",
     "prepublishOnly": "bun run typecheck && bun run build",
     "bench": "bun run test/verify.ts"
   },
@@ -74,6 +75,15 @@
   },
   "devDependencies": {
     "@types/node": "^22.20.2",
+    "playwright-core": "1.61.0",
     "typescript": "^5.5.0"
+  },
+  "peerDependencies": {
+    "playwright-core": ">=1.61.0"
+  },
+  "peerDependenciesMeta": {
+    "playwright-core": {
+      "optional": true
+    }
   }
 }