blitzstrike 1.0.59 → 1.0.62

package/CHANGELOG.md

@@ -5,6 +5,40 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.62] — 2026-09-13
+
+### Added — route-confusion & dispatch-abuse detection
+
+New vulnerability class distinct from source→sink taint (`src/route-confusion.ts`):
+detects when the routing/dispatch layer lets an attacker reach an unintended
+handler or control which handler runs.
+
+- `dynamic_dispatch` — attacker-controlled callback/route (`call_user_func`,
+  `forward`, `dispatch`, `resolve_route`, `invoke`).
+- `dynamic_method_call` — `$obj->$method()` / `$class::$method()`.
+- `dynamic_include` — `include`/`require` of a variable (LFI via route).
+- `batch_forwarding` — a loop over sub-requests that forwards to inner handlers
+  without a per-route authorization re-check.
+- `route_normalization_gap` — route matching against user input without path
+  normalization (strtolower/rtrim/urldecode).
+
+Wired into the `@source` agent; findings become `route` nodes in the security
+graph. Added a WordPress-style batch-endpoint fixture to the enterprise
+benchmark (`wp-batch-route`).
+
+## [1.0.60] — 2026-09-13
+
+### Added — deeper taint-flow coverage
+
+- **Method-call resolution** (`calleeName`) — `$obj->method()` now resolves to
+  its method definition for interprocedural taint, not the object variable.
+- **Built-in taint propagation** — `implode`/`join`/`sprintf`/`str_replace` and
+  other array→string/format built-ins now carry taint through to the sink.
+- **Cast handling** — `(array)`/`(string)` casts propagate taint (a string can
+  still carry a payload); `(int)`/`(float)` casts act as an int_cast sanitizer.
+- New corpus fixtures covering conditional-sanitizer bypass on array→SQL
+  interpolation (`php-int-cast-bypass-vuln`/`-fixed`).
+
 ## [1.0.59] — 2026-09-13
 
 ### Added — enterprise-grade detection + benchmark

package/bench/corpus/php-int-cast-bypass-fixed.md

@@ -0,0 +1,20 @@
+- id: php-int-cast-bypass-fixed
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+class Query {
+  public function run($params) {
+    $where = "";
+    if ( ! empty( $params["ids"] ) ) {
+      $ids = implode( ",", array_map( "intval", (array) $params["ids"] ) );
+      $where .= " AND id NOT IN ($ids) ";
+    }
+    return $db->query("SELECT * FROM t WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new Query();
+$w->run($q);
+```

package/bench/corpus/php-int-cast-bypass-vuln.md

@@ -0,0 +1,23 @@
+- id: php-int-cast-bypass-vuln
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+class Query {
+  public function run($params) {
+    $where = "";
+    if ( ! empty( $params["ids"] ) ) {
+      if ( is_array( $params["ids"] ) ) {
+        $params["ids"] = array_map( "intval", $params["ids"] );
+      }
+      $ids = implode( ",", (array) $params["ids"] );
+      $where .= " AND id NOT IN ($ids) ";
+    }
+    return $db->query("SELECT * FROM t WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new Query();
+$w->run($q);
+```

package/bench/enterprise/wp-batch-route/batch.php

@@ -0,0 +1,43 @@
+<?php
+/**
+ * REST API batch endpoint (simplified) — forwards to inner handlers.
+ *
+ * The `/batch` route is registered WITHOUT a permission_callback, so it is
+ * reachable unauthenticated. A malformed nested request desynchronizes the
+ * batch router, letting an attacker reach handlers they should not.
+ */
+
+add_action('rest_api_init', function () {
+    register_rest_route('my/v1', '/batch', array(
+        'methods'             => 'POST',
+        'callback'            => 'handle_batch',
+        'permission_callback' => '__return_true', // <-- no real authz check
+    ));
+});
+
+function handle_batch($request) {
+    $operations = $request['requests'];
+    $responses  = array();
+
+    foreach ($operations as $op) {
+        $route    = $op['route'];
+        $handler  = resolve_route($route);
+        $responses[] = $handler($op['params']);
+    }
+
+    return $responses;
+}
+
+function resolve_route($route) {
+    $registry = array(
+        'users'   => 'get_users',
+        'posts'   => 'get_posts',
+        'options' => 'get_options',
+    );
+    return $registry[$route];
+}
+
+function get_users($params) {
+    global $wpdb;
+    return $wpdb->get_results("SELECT * FROM users WHERE id = " . $params['id']);
+}

package/dist/index.js

@@ -17104,6 +17104,15 @@ function rootVarName2(node) {
     return rootVarName2(node.what);
   return null;
 }
+function calleeName(what) {
+  if (!isNode3(what))
+    return null;
+  if (what.kind === "name")
+    return typeof what.name === "string" ? what.name : what.name?.name ?? null;
+  if (what.kind === "propertylookup" || what.kind === "staticlookup")
+    return what.offset?.name ?? what.offset?.value ?? null;
+  return null;
+}
 function sourceOf2(node) {
   if (!isNode3(node))
     return null;
@@ -17268,6 +17277,14 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
   const src = sourceOf2(node);
   if (src)
     return { tainted: true, sources: [src], sanitizers: [], sourceLine: node.loc?.start?.line };
+  if (node.kind === "cast") {
+    const inner = analyzeExpr(node.expr, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    const castType = String(node.type ?? "");
+    if (/^(int|integer|bool|boolean|float|double)$/i.test(castType) && inner.tainted) {
+      return { ...inner, sanitizers: [...inner.sanitizers, { id: "int_cast", label: "Numeric cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] }] };
+    }
+    return inner;
+  }
   if (node.kind === "assign") {
     const byref = node.operator === "=&";
     const rhs = analyzeExpr(node.right, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
@@ -17315,8 +17332,11 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
         analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
       return taintedArgs.length > 0 ? mergeTaint(...taintedArgs) : CLEAN;
     }
-    const fnName = rootVarName2(node.what);
+    const fnName = calleeName(node.what);
     if (fnName) {
+      if (TAINT_PROPAGATING_BUILTINS.has(fnName) && taintedArgs.length > 0) {
+        return mergeTaint(...taintedArgs);
+      }
       const san = findSanitizers(fnName + "(");
       if (san.length > 0) {
         if (taintedArgs.length > 0) {
@@ -17575,7 +17595,7 @@ function analyzeDataFlow2(path) {
   const seen = new Set;
   const mainCalls = topStmts.flatMap((s) => findKind2(s, "call"));
   for (const call of mainCalls) {
-    const fnName = rootVarName2(call.what);
+    const fnName = calleeName(call.what);
     if (!fnName || sinkClassOf2(call))
       continue;
     const target = resolveFuncId(fnName, summaries);
@@ -17662,7 +17682,7 @@ function analyzeDataFlow2(path) {
     setCache("eagle2", cacheCode, result);
   return result;
 }
-var import_php_parser3, parser3, CLEAN, VALIDATION_GATES;
+var import_php_parser3, parser3, TAINT_PROPAGATING_BUILTINS, CLEAN, VALIDATION_GATES;
 var init_eagle2 = __esm(() => {
   init_dataflow();
   init_scanner();
@@ -17673,6 +17693,33 @@ var init_eagle2 = __esm(() => {
     parser: { extractDoc: false, php7: true },
     ast: { withPositions: true, withSource: false }
   });
+  TAINT_PROPAGATING_BUILTINS = new Set([
+    "implode",
+    "join",
+    "sprintf",
+    "vsprintf",
+    "str_replace",
+    "str_ireplace",
+    "substr",
+    "mb_substr",
+    "substr_replace",
+    "trim",
+    "ltrim",
+    "rtrim",
+    "strtolower",
+    "strtoupper",
+    "ucfirst",
+    "lcfirst",
+    "urldecode",
+    "rawurldecode",
+    "base64_decode",
+    "html_entity_decode",
+    "stripslashes",
+    "addslashes",
+    "strval",
+    "preg_quote",
+    "nl2br"
+  ]);
   CLEAN = { tainted: false, sources: [], sanitizers: [] };
   VALIDATION_GATES = ["in_array", "preg_match", "ctype_digit", "ctype_alnum", "is_numeric"];
 });
@@ -37002,6 +37049,151 @@ function reviewValidated(mission) {
 }
 var init_reviewer = () => {};
 
+// src/route-confusion.ts
+function lines(code) {
+  return code.split(`
+`);
+}
+function lineNo(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function userControlled(scope) {
+  return SOURCE_TOKENS.test(scope);
+}
+function detectDynamicDispatch(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_DISPATCH_RE.lastIndex = 0;
+  let m;
+  while ((m = DYNAMIC_DISPATCH_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_dispatch",
+      category: "Route confusion (user-controlled dispatch)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` invoked with an attacker-controlled callback/route — the request selects the handler.`
+    });
+  }
+}
+function detectDynamicMethod(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_METHOD_RE.lastIndex = 0;
+  let m;
+  while ((m = DYNAMIC_METHOD_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_method_call",
+      category: "Route confusion (dynamic method dispatch)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "Dynamic method/static call `" + m[1] + "$var()` — the invoked symbol is attacker-influenced."
+    });
+  }
+}
+function detectDynamicInclude(code, file, out) {
+  const ls = lines(code);
+  const re = /\b(include|require)(_once)?\s*\(\s*(\$[A-Za-z_]\w*)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_include",
+      category: "Route confusion (dynamic file include)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}(…)\` of a variable — potential LFI/RCE when the path is attacker-controlled.`
+    });
+  }
+}
+function detectBatchForwarding(code, file, out) {
+  BATCH_LOOP_RE.lastIndex = 0;
+  let m;
+  while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const body = lines(code).slice(ln, ln + 8).join(`
+`);
+    const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
+    if (!forwards)
+      continue;
+    const rechecks = /\b(current_user_can|permission_callback|check_ajax_referer|authorize|authorise|is_user_logged_in)\b/i.test(body);
+    out.push({
+      file,
+      line: ln,
+      type: "batch_forwarding",
+      category: "Route confusion (batch/proxy forwarding)",
+      severity: rechecks ? "medium" : "high",
+      evidence: lines(code)[ln - 1]?.trim() ?? "",
+      detail: rechecks ? "Batch/proxy loop forwards to inner handlers — auth is re-checked in scope, but verify it applies per-route." : "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
+    });
+  }
+}
+function detectRouteNormalization(code, file, out) {
+  const ls = lines(code);
+  for (let i = 0;i < ls.length; i++) {
+    const l = ls[i];
+    if (!ROUTE_MATCH_RE.test(l))
+      continue;
+    const scope = ls.slice(Math.max(0, i - 3), i + 1).join(`
+`);
+    if (!userControlled(scope))
+      continue;
+    if (NORMALIZERS.test(l) || NORMALIZERS.test(scope))
+      continue;
+    out.push({
+      file,
+      line: i + 1,
+      type: "route_normalization_gap",
+      category: "Route confusion (missing path normalization)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "Route matched against user input without visible normalization (strtolower/rtrim/urldecode) — route desync possible."
+    });
+  }
+}
+function detectRouteConfusion(code, file) {
+  const out = [];
+  detectDynamicDispatch(code, file, out);
+  detectDynamicMethod(code, file, out);
+  detectDynamicInclude(code, file, out);
+  detectBatchForwarding(code, file, out);
+  detectRouteNormalization(code, file, out);
+  return out;
+}
+var SOURCE_TOKENS, DYNAMIC_DISPATCH_RE, DYNAMIC_METHOD_RE, BATCH_LOOP_RE, ROUTE_MATCH_RE, NORMALIZERS;
+var init_route_confusion = __esm(() => {
+  SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
+  DYNAMIC_DISPATCH_RE = /\b(call_user_func|call_user_func_array|forward|dispatch|resolve_route|invoke)\s*\(\s*(\$|\[)/gi;
+  DYNAMIC_METHOD_RE = /(->|::)\s*\$[A-Za-z_]/g;
+  BATCH_LOOP_RE = /\bforeach\s*\([^)]*(requests|batch|sub_requests|operations)\b/gi;
+  ROUTE_MATCH_RE = /\b(preg_match|preg_match_all|strpos|stripos|str_contains)\s*\(/i;
+  NORMALIZERS = /\b(strtolower|strtoupper|rtrim|urldecode|rawurldecode|parse_url|normalize|canonical)\b/i;
+});
+
 // src/agents.ts
 import { readFileSync as readFileSync18 } from "node:fs";
 function emptyGraph() {
@@ -37025,6 +37217,7 @@ var init_agents = __esm(() => {
   init_scanner();
   init_eagle2();
   init_universal_taint();
+  init_route_confusion();
   init_adapters();
   init_active();
   init_strike();
@@ -37109,6 +37302,29 @@ var init_agents = __esm(() => {
           graph = addEdge2(graph, tid, sinkId, "flows_to");
         }
       }
+      for (const f of files.filter((x) => /\.php$/i.test(x))) {
+        let code;
+        try {
+          code = readFileSync18(f, "utf8");
+        } catch {
+          continue;
+        }
+        for (const rc of detectRouteConfusion(code, f).slice(0, 50)) {
+          const hyp = makeHypothesis({
+            type: rc.category,
+            target: `${f}:${rc.line}`,
+            evidence: rc.detail,
+            confidence: rc.severity === "high" ? 0.7 : 0.5,
+            required_validation: "confirm reachability of the dispatch/route with attacker-controlled input",
+            potential_impact: "route confusion / authorization bypass"
+          });
+          hypotheses.push(hyp);
+          findings += 1;
+          const nodeId = `route:${f}:${rc.line}:${rc.type}`;
+          graph = upsertNode(graph, nodeId, "route", { file: f, line: rc.line, type: rc.type, hypothesis: hyp.id });
+          graph = addEdge2(graph, tid, nodeId, "routes_to");
+        }
+      }
       return { ok: true, output: { files: files.length, findings }, hypotheses, graph };
     }
   };
@@ -38044,6 +38260,13 @@ var init_enterprise_benchmark = __esm(() => {
       expected_vulns: 2,
       expected_sinks: ["sql_execution", "command_execution"],
       safe_tokens: ["prepareStatement", "PreparedStatement"]
+    },
+    {
+      id: "wp-batch-route",
+      dir: join17(ROOT10, "wp-batch-route"),
+      expected_vulns: 1,
+      expected_sinks: ["Route confusion"],
+      safe_tokens: []
     }
   ];
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.59",
+  "version": "1.0.62",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {