blitzstrike 1.0.59 → 1.0.60

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.60] — 2026-09-13
+
+### Added — deep taint-flow + CVE pattern coverage (CVE-2026-60137)
+
+Investigated the WordPress core chain CVE-2026-60137 (`author__not_in` SQLi) /
+CVE-2026-63030 (REST API batch route confusion → RCE). The SQLi base was a
+**type-confusion sanitizer bypass**: `absint` guarded by `if ( is_array() )` +
+a `(array)` cast + `implode` that re-interpolates the raw string. The engine
+now detects it:
+
+- **Method-call resolution** (`calleeName`) — `$obj->method()` now resolves to
+  its method definition for interprocedural taint, not the object variable.
+- **Built-in taint propagation** — `implode`/`join`/`sprintf`/`str_replace` and
+  other array→string/format built-ins now carry taint through to the sink.
+- **Cast handling** — `(array)`/`(string)` casts propagate taint (a string can
+  still carry a payload); `(int)`/`(float)` casts act as an int_cast sanitizer.
+- **`wp_parse_id_list`** added as an integer-cast sanitizer.
+
+The conditional-flow merge already models the `is_array` guard correctly, so the
+engine distinguishes the bypassable sanitizer (vulnerable) from the unconditional
+one (fixed). Added two corpus fixtures (`wp-author-not-in-vuln`/`-fixed`).
+
+### Not yet detected
+
+- **CVE-2026-63030** (REST API batch endpoint route confusion) is a routing /
+  authorization-logic bug, not a source→sink taint flow — out of scope for the
+  current taint engine.
+
 ## [1.0.59] — 2026-09-13
 
 ### Added — enterprise-grade detection + benchmark

package/bench/corpus/wp-author-not-in-fixed.md

@@ -0,0 +1,21 @@
+- id: wp-author-not-in-fixed
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+class WP_Query {
+  public function get_posts($qv) {
+    $where = "";
+    if ( ! empty( $qv["author__not_in"] ) ) {
+      $ids = wp_parse_id_list( $qv["author__not_in"] );
+      $author__not_in = implode( ",", $ids );
+      $where .= " AND post_author NOT IN ($author__not_in) ";
+    }
+    return $wpdb->query("SELECT * FROM posts WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new WP_Query();
+$w->get_posts($q);
+```

package/bench/corpus/wp-author-not-in-vuln.md

@@ -0,0 +1,23 @@
+- id: wp-author-not-in-vuln
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+class WP_Query {
+  public function get_posts($qv) {
+    $where = "";
+    if ( ! empty( $qv["author__not_in"] ) ) {
+      if ( is_array( $qv["author__not_in"] ) ) {
+        $qv["author__not_in"] = array_map( "absint", $qv["author__not_in"] );
+      }
+      $author__not_in = implode( ",", (array) $qv["author__not_in"] );
+      $where .= " AND post_author NOT IN ($author__not_in) ";
+    }
+    return $wpdb->query("SELECT * FROM posts WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new WP_Query();
+$w->get_posts($q);
+```

package/dist/index.js

@@ -9190,6 +9190,7 @@ var init_dataflow = __esm(() => {
     escapeshellcmd: { id: "shell_escape", label: "Shell command escape", neutralizes: ["command_execution"] },
     intval: { id: "int_cast", label: "Integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
     absint: { id: "int_cast", label: "Absolute integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
+    wp_parse_id_list: { id: "int_cast", label: "WordPress ID list cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
     "preg_replace.*FILTER": { id: "regex_filter", label: "Regex filter", neutralizes: ["html_render"] }
   };
 });
@@ -17104,6 +17105,15 @@ function rootVarName2(node) {
     return rootVarName2(node.what);
   return null;
 }
+function calleeName(what) {
+  if (!isNode3(what))
+    return null;
+  if (what.kind === "name")
+    return typeof what.name === "string" ? what.name : what.name?.name ?? null;
+  if (what.kind === "propertylookup" || what.kind === "staticlookup")
+    return what.offset?.name ?? what.offset?.value ?? null;
+  return null;
+}
 function sourceOf2(node) {
   if (!isNode3(node))
     return null;
@@ -17268,6 +17278,14 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
   const src = sourceOf2(node);
   if (src)
     return { tainted: true, sources: [src], sanitizers: [], sourceLine: node.loc?.start?.line };
+  if (node.kind === "cast") {
+    const inner = analyzeExpr(node.expr, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    const castType = String(node.type ?? "");
+    if (/^(int|integer|bool|boolean|float|double)$/i.test(castType) && inner.tainted) {
+      return { ...inner, sanitizers: [...inner.sanitizers, { id: "int_cast", label: "Numeric cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] }] };
+    }
+    return inner;
+  }
   if (node.kind === "assign") {
     const byref = node.operator === "=&";
     const rhs = analyzeExpr(node.right, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
@@ -17315,8 +17333,11 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
         analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
       return taintedArgs.length > 0 ? mergeTaint(...taintedArgs) : CLEAN;
     }
-    const fnName = rootVarName2(node.what);
+    const fnName = calleeName(node.what);
     if (fnName) {
+      if (TAINT_PROPAGATING_BUILTINS.has(fnName) && taintedArgs.length > 0) {
+        return mergeTaint(...taintedArgs);
+      }
       const san = findSanitizers(fnName + "(");
       if (san.length > 0) {
         if (taintedArgs.length > 0) {
@@ -17575,7 +17596,7 @@ function analyzeDataFlow2(path) {
   const seen = new Set;
   const mainCalls = topStmts.flatMap((s) => findKind2(s, "call"));
   for (const call of mainCalls) {
-    const fnName = rootVarName2(call.what);
+    const fnName = calleeName(call.what);
     if (!fnName || sinkClassOf2(call))
       continue;
     const target = resolveFuncId(fnName, summaries);
@@ -17662,7 +17683,7 @@ function analyzeDataFlow2(path) {
     setCache("eagle2", cacheCode, result);
   return result;
 }
-var import_php_parser3, parser3, CLEAN, VALIDATION_GATES;
+var import_php_parser3, parser3, TAINT_PROPAGATING_BUILTINS, CLEAN, VALIDATION_GATES;
 var init_eagle2 = __esm(() => {
   init_dataflow();
   init_scanner();
@@ -17673,6 +17694,33 @@ var init_eagle2 = __esm(() => {
     parser: { extractDoc: false, php7: true },
     ast: { withPositions: true, withSource: false }
   });
+  TAINT_PROPAGATING_BUILTINS = new Set([
+    "implode",
+    "join",
+    "sprintf",
+    "vsprintf",
+    "str_replace",
+    "str_ireplace",
+    "substr",
+    "mb_substr",
+    "substr_replace",
+    "trim",
+    "ltrim",
+    "rtrim",
+    "strtolower",
+    "strtoupper",
+    "ucfirst",
+    "lcfirst",
+    "urldecode",
+    "rawurldecode",
+    "base64_decode",
+    "html_entity_decode",
+    "stripslashes",
+    "addslashes",
+    "strval",
+    "preg_quote",
+    "nl2br"
+  ]);
   CLEAN = { tainted: false, sources: [], sanitizers: [] };
   VALIDATION_GATES = ["in_array", "preg_match", "ctype_digit", "ctype_alnum", "is_numeric"];
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.59",
+  "version": "1.0.60",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {