blitzstrike 1.0.60 → 1.0.62

package/CHANGELOG.md

@@ -5,15 +5,30 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [1.0.60] — 2026-09-13
+## [1.0.62] — 2026-09-13
+
+### Added — route-confusion & dispatch-abuse detection
+
+New vulnerability class distinct from source→sink taint (`src/route-confusion.ts`):
+detects when the routing/dispatch layer lets an attacker reach an unintended
+handler or control which handler runs.
 
-### Added — deep taint-flow + CVE pattern coverage (CVE-2026-60137)
+- `dynamic_dispatch` — attacker-controlled callback/route (`call_user_func`,
+  `forward`, `dispatch`, `resolve_route`, `invoke`).
+- `dynamic_method_call` — `$obj->$method()` / `$class::$method()`.
+- `dynamic_include` — `include`/`require` of a variable (LFI via route).
+- `batch_forwarding` — a loop over sub-requests that forwards to inner handlers
+  without a per-route authorization re-check.
+- `route_normalization_gap` — route matching against user input without path
+  normalization (strtolower/rtrim/urldecode).
 
-Investigated the WordPress core chain CVE-2026-60137 (`author__not_in` SQLi) /
-CVE-2026-63030 (REST API batch route confusion → RCE). The SQLi base was a
-**type-confusion sanitizer bypass**: `absint` guarded by `if ( is_array() )` +
-a `(array)` cast + `implode` that re-interpolates the raw string. The engine
-now detects it:
+Wired into the `@source` agent; findings become `route` nodes in the security
+graph. Added a WordPress-style batch-endpoint fixture to the enterprise
+benchmark (`wp-batch-route`).
+
+## [1.0.60] — 2026-09-13
+
+### Added — deeper taint-flow coverage
 
 - **Method-call resolution** (`calleeName`) — `$obj->method()` now resolves to
   its method definition for interprocedural taint, not the object variable.
@@ -21,17 +36,8 @@ now detects it:
   other array→string/format built-ins now carry taint through to the sink.
 - **Cast handling** — `(array)`/`(string)` casts propagate taint (a string can
   still carry a payload); `(int)`/`(float)` casts act as an int_cast sanitizer.
-- **`wp_parse_id_list`** added as an integer-cast sanitizer.
-
-The conditional-flow merge already models the `is_array` guard correctly, so the
-engine distinguishes the bypassable sanitizer (vulnerable) from the unconditional
-one (fixed). Added two corpus fixtures (`wp-author-not-in-vuln`/`-fixed`).
-
-### Not yet detected
-
-- **CVE-2026-63030** (REST API batch endpoint route confusion) is a routing /
-  authorization-logic bug, not a source→sink taint flow — out of scope for the
-  current taint engine.
+- New corpus fixtures covering conditional-sanitizer bypass on array→SQL
+  interpolation (`php-int-cast-bypass-vuln`/`-fixed`).
 
 ## [1.0.59] — 2026-09-13
 

package/bench/corpus/php-int-cast-bypass-fixed.md

@@ -0,0 +1,20 @@
+- id: php-int-cast-bypass-fixed
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+class Query {
+  public function run($params) {
+    $where = "";
+    if ( ! empty( $params["ids"] ) ) {
+      $ids = implode( ",", array_map( "intval", (array) $params["ids"] ) );
+      $where .= " AND id NOT IN ($ids) ";
+    }
+    return $db->query("SELECT * FROM t WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new Query();
+$w->run($q);
+```

package/bench/corpus/php-int-cast-bypass-vuln.md

@@ -0,0 +1,23 @@
+- id: php-int-cast-bypass-vuln
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+class Query {
+  public function run($params) {
+    $where = "";
+    if ( ! empty( $params["ids"] ) ) {
+      if ( is_array( $params["ids"] ) ) {
+        $params["ids"] = array_map( "intval", $params["ids"] );
+      }
+      $ids = implode( ",", (array) $params["ids"] );
+      $where .= " AND id NOT IN ($ids) ";
+    }
+    return $db->query("SELECT * FROM t WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new Query();
+$w->run($q);
+```

package/bench/enterprise/wp-batch-route/batch.php

@@ -0,0 +1,43 @@
+<?php
+/**
+ * REST API batch endpoint (simplified) — forwards to inner handlers.
+ *
+ * The `/batch` route is registered WITHOUT a permission_callback, so it is
+ * reachable unauthenticated. A malformed nested request desynchronizes the
+ * batch router, letting an attacker reach handlers they should not.
+ */
+
+add_action('rest_api_init', function () {
+    register_rest_route('my/v1', '/batch', array(
+        'methods'             => 'POST',
+        'callback'            => 'handle_batch',
+        'permission_callback' => '__return_true', // <-- no real authz check
+    ));
+});
+
+function handle_batch($request) {
+    $operations = $request['requests'];
+    $responses  = array();
+
+    foreach ($operations as $op) {
+        $route    = $op['route'];
+        $handler  = resolve_route($route);
+        $responses[] = $handler($op['params']);
+    }
+
+    return $responses;
+}
+
+function resolve_route($route) {
+    $registry = array(
+        'users'   => 'get_users',
+        'posts'   => 'get_posts',
+        'options' => 'get_options',
+    );
+    return $registry[$route];
+}
+
+function get_users($params) {
+    global $wpdb;
+    return $wpdb->get_results("SELECT * FROM users WHERE id = " . $params['id']);
+}

package/dist/index.js

@@ -9190,7 +9190,6 @@ var init_dataflow = __esm(() => {
     escapeshellcmd: { id: "shell_escape", label: "Shell command escape", neutralizes: ["command_execution"] },
     intval: { id: "int_cast", label: "Integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
     absint: { id: "int_cast", label: "Absolute integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
-    wp_parse_id_list: { id: "int_cast", label: "WordPress ID list cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
     "preg_replace.*FILTER": { id: "regex_filter", label: "Regex filter", neutralizes: ["html_render"] }
   };
 });
@@ -37050,6 +37049,151 @@ function reviewValidated(mission) {
 }
 var init_reviewer = () => {};
 
+// src/route-confusion.ts
+function lines(code) {
+  return code.split(`
+`);
+}
+function lineNo(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function userControlled(scope) {
+  return SOURCE_TOKENS.test(scope);
+}
+function detectDynamicDispatch(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_DISPATCH_RE.lastIndex = 0;
+  let m;
+  while ((m = DYNAMIC_DISPATCH_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_dispatch",
+      category: "Route confusion (user-controlled dispatch)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` invoked with an attacker-controlled callback/route — the request selects the handler.`
+    });
+  }
+}
+function detectDynamicMethod(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_METHOD_RE.lastIndex = 0;
+  let m;
+  while ((m = DYNAMIC_METHOD_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_method_call",
+      category: "Route confusion (dynamic method dispatch)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "Dynamic method/static call `" + m[1] + "$var()` — the invoked symbol is attacker-influenced."
+    });
+  }
+}
+function detectDynamicInclude(code, file, out) {
+  const ls = lines(code);
+  const re = /\b(include|require)(_once)?\s*\(\s*(\$[A-Za-z_]\w*)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_include",
+      category: "Route confusion (dynamic file include)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}(…)\` of a variable — potential LFI/RCE when the path is attacker-controlled.`
+    });
+  }
+}
+function detectBatchForwarding(code, file, out) {
+  BATCH_LOOP_RE.lastIndex = 0;
+  let m;
+  while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const body = lines(code).slice(ln, ln + 8).join(`
+`);
+    const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
+    if (!forwards)
+      continue;
+    const rechecks = /\b(current_user_can|permission_callback|check_ajax_referer|authorize|authorise|is_user_logged_in)\b/i.test(body);
+    out.push({
+      file,
+      line: ln,
+      type: "batch_forwarding",
+      category: "Route confusion (batch/proxy forwarding)",
+      severity: rechecks ? "medium" : "high",
+      evidence: lines(code)[ln - 1]?.trim() ?? "",
+      detail: rechecks ? "Batch/proxy loop forwards to inner handlers — auth is re-checked in scope, but verify it applies per-route." : "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
+    });
+  }
+}
+function detectRouteNormalization(code, file, out) {
+  const ls = lines(code);
+  for (let i = 0;i < ls.length; i++) {
+    const l = ls[i];
+    if (!ROUTE_MATCH_RE.test(l))
+      continue;
+    const scope = ls.slice(Math.max(0, i - 3), i + 1).join(`
+`);
+    if (!userControlled(scope))
+      continue;
+    if (NORMALIZERS.test(l) || NORMALIZERS.test(scope))
+      continue;
+    out.push({
+      file,
+      line: i + 1,
+      type: "route_normalization_gap",
+      category: "Route confusion (missing path normalization)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "Route matched against user input without visible normalization (strtolower/rtrim/urldecode) — route desync possible."
+    });
+  }
+}
+function detectRouteConfusion(code, file) {
+  const out = [];
+  detectDynamicDispatch(code, file, out);
+  detectDynamicMethod(code, file, out);
+  detectDynamicInclude(code, file, out);
+  detectBatchForwarding(code, file, out);
+  detectRouteNormalization(code, file, out);
+  return out;
+}
+var SOURCE_TOKENS, DYNAMIC_DISPATCH_RE, DYNAMIC_METHOD_RE, BATCH_LOOP_RE, ROUTE_MATCH_RE, NORMALIZERS;
+var init_route_confusion = __esm(() => {
+  SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
+  DYNAMIC_DISPATCH_RE = /\b(call_user_func|call_user_func_array|forward|dispatch|resolve_route|invoke)\s*\(\s*(\$|\[)/gi;
+  DYNAMIC_METHOD_RE = /(->|::)\s*\$[A-Za-z_]/g;
+  BATCH_LOOP_RE = /\bforeach\s*\([^)]*(requests|batch|sub_requests|operations)\b/gi;
+  ROUTE_MATCH_RE = /\b(preg_match|preg_match_all|strpos|stripos|str_contains)\s*\(/i;
+  NORMALIZERS = /\b(strtolower|strtoupper|rtrim|urldecode|rawurldecode|parse_url|normalize|canonical)\b/i;
+});
+
 // src/agents.ts
 import { readFileSync as readFileSync18 } from "node:fs";
 function emptyGraph() {
@@ -37073,6 +37217,7 @@ var init_agents = __esm(() => {
   init_scanner();
   init_eagle2();
   init_universal_taint();
+  init_route_confusion();
   init_adapters();
   init_active();
   init_strike();
@@ -37157,6 +37302,29 @@ var init_agents = __esm(() => {
           graph = addEdge2(graph, tid, sinkId, "flows_to");
         }
       }
+      for (const f of files.filter((x) => /\.php$/i.test(x))) {
+        let code;
+        try {
+          code = readFileSync18(f, "utf8");
+        } catch {
+          continue;
+        }
+        for (const rc of detectRouteConfusion(code, f).slice(0, 50)) {
+          const hyp = makeHypothesis({
+            type: rc.category,
+            target: `${f}:${rc.line}`,
+            evidence: rc.detail,
+            confidence: rc.severity === "high" ? 0.7 : 0.5,
+            required_validation: "confirm reachability of the dispatch/route with attacker-controlled input",
+            potential_impact: "route confusion / authorization bypass"
+          });
+          hypotheses.push(hyp);
+          findings += 1;
+          const nodeId = `route:${f}:${rc.line}:${rc.type}`;
+          graph = upsertNode(graph, nodeId, "route", { file: f, line: rc.line, type: rc.type, hypothesis: hyp.id });
+          graph = addEdge2(graph, tid, nodeId, "routes_to");
+        }
+      }
       return { ok: true, output: { files: files.length, findings }, hypotheses, graph };
     }
   };
@@ -38092,6 +38260,13 @@ var init_enterprise_benchmark = __esm(() => {
       expected_vulns: 2,
       expected_sinks: ["sql_execution", "command_execution"],
       safe_tokens: ["prepareStatement", "PreparedStatement"]
+    },
+    {
+      id: "wp-batch-route",
+      dir: join17(ROOT10, "wp-batch-route"),
+      expected_vulns: 1,
+      expected_sinks: ["Route confusion"],
+      safe_tokens: []
     }
   ];
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.60",
+  "version": "1.0.62",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/bench/corpus/wp-author-not-in-fixed.md

@@ -1,21 +0,0 @@
-- id: wp-author-not-in-fixed
-- language: php
-- vulnerable: false
-- sink_type: sql_execution
-```php
-<?php
-class WP_Query {
-  public function get_posts($qv) {
-    $where = "";
-    if ( ! empty( $qv["author__not_in"] ) ) {
-      $ids = wp_parse_id_list( $qv["author__not_in"] );
-      $author__not_in = implode( ",", $ids );
-      $where .= " AND post_author NOT IN ($author__not_in) ";
-    }
-    return $wpdb->query("SELECT * FROM posts WHERE 1=1 $where");
-  }
-}
-$q = $_GET;
-$w = new WP_Query();
-$w->get_posts($q);
-```

package/bench/corpus/wp-author-not-in-vuln.md

@@ -1,23 +0,0 @@
-- id: wp-author-not-in-vuln
-- language: php
-- vulnerable: true
-- sink_type: sql_execution
-```php
-<?php
-class WP_Query {
-  public function get_posts($qv) {
-    $where = "";
-    if ( ! empty( $qv["author__not_in"] ) ) {
-      if ( is_array( $qv["author__not_in"] ) ) {
-        $qv["author__not_in"] = array_map( "absint", $qv["author__not_in"] );
-      }
-      $author__not_in = implode( ",", (array) $qv["author__not_in"] );
-      $where .= " AND post_author NOT IN ($author__not_in) ";
-    }
-    return $wpdb->query("SELECT * FROM posts WHERE 1=1 $where");
-  }
-}
-$q = $_GET;
-$w = new WP_Query();
-$w->get_posts($q);
-```