blitzstrike 1.0.62 → 1.0.63

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.63] — 2026-09-13
+
+### Added — complex-bug detection (`src/complex-bugs.ts`)
+
+Three "hard" vulnerability classes beyond source→sink taint:
+
+- **Deserialization → POP gadget chain** — `unserialize()` of attacker-controlled
+  data when a magic method (`__destruct`/`__wakeup`/`__toString`/`__invoke`/`__call`)
+  is present in the file (object injection → RCE pivot).
+- **Type juggling** — loose comparison (`==`/`!=`) of user input against a
+  hash/secret (PHP `0e…` collision auth bypass); strict `===` is ignored.
+- **Mass assignment** — `extract()` of request data without `EXTR_SKIP`, or
+  `parse_str()` of user input (variable injection).
+
+Wired into the `@source` agent as `vulnerability` graph nodes. Added a
+`php-complex` fixture to the enterprise benchmark.
+
 ## [1.0.62] — 2026-09-13
 
 ### Added — route-confusion & dispatch-abuse detection

package/bench/enterprise/php-complex/plugin.php

@@ -0,0 +1,34 @@
+<?php
+/**
+ * Plugin helper (simplified) with multiple complex-bug patterns.
+ */
+
+// 1. Deserialization → object injection (magic method present)
+function restore_session($payload) {
+    $data = $_POST['data'];
+    $obj  = unserialize($data);
+    return $obj;
+}
+
+class CacheManager {
+    public function __destruct() {
+        // Magic method — a POP gadget can pivot object injection to RCE here.
+        system("rm -rf /tmp/cache");
+    }
+}
+
+// 2. Type juggling — loose comparison of user input against a hash
+function verify_signature() {
+    $sig    = $_GET['sig'];
+    $secret = get_option('signing_secret');
+    if ($sig == $secret) {          // <-- loose == , 0e... collision bypass
+        return true;
+    }
+    return false;
+}
+
+// 3. Mass assignment — extract() of request data without EXTR_SKIP
+function bootstrap_options() {
+    extract($_REQUEST);             // <-- variable injection
+    return $admin;                  // $admin is attacker-controlled
+}

package/dist/index.js

@@ -37186,7 +37186,7 @@ function detectRouteConfusion(code, file) {
 }
 var SOURCE_TOKENS, DYNAMIC_DISPATCH_RE, DYNAMIC_METHOD_RE, BATCH_LOOP_RE, ROUTE_MATCH_RE, NORMALIZERS;
 var init_route_confusion = __esm(() => {
-  SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
+  SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
   DYNAMIC_DISPATCH_RE = /\b(call_user_func|call_user_func_array|forward|dispatch|resolve_route|invoke)\s*\(\s*(\$|\[)/gi;
   DYNAMIC_METHOD_RE = /(->|::)\s*\$[A-Za-z_]/g;
   BATCH_LOOP_RE = /\bforeach\s*\([^)]*(requests|batch|sub_requests|operations)\b/gi;
@@ -37194,6 +37194,124 @@ var init_route_confusion = __esm(() => {
   NORMALIZERS = /\b(strtolower|strtoupper|rtrim|urldecode|rawurldecode|parse_url|normalize|canonical)\b/i;
 });
 
+// src/complex-bugs.ts
+function lines2(code) {
+  return code.split(`
+`);
+}
+function lineNo2(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function detectDeserialization(code, file, out) {
+  if (!MAGIC_METHODS.test(code))
+    return;
+  const ls = lines2(code);
+  const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "deserialization",
+      category: "Deserialization → POP gadget chain",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
+    });
+  }
+}
+function detectTypeJuggling(code, file, out) {
+  const ls = lines2(code);
+  const re = /(?<![=!<>])(==|!=)(?!=)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    const hasSource = SOURCE_TOKENS2.test(l) || SOURCE_TOKENS2.test(scope);
+    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /\b(secret|token|nonce|hash)\b/i.test(l);
+    if (!hasSource || !hasHash)
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "type_juggling",
+      category: "Type juggling (loose comparison)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: 'Loose comparison of user input against a hash/secret — PHP type juggling (`0e…`, `"str" == 0`) may bypass the check. Use strict `===`.'
+    });
+  }
+}
+function detectMassAssignment(code, file, out) {
+  const ls = lines2(code);
+  const extractRe = /\bextract\s*\(\s*[^)]*(REQUEST|POST|GET|COOKIE|FILES|\$_(REQUEST|POST|GET|COOKIE|FILES))/g;
+  let m;
+  while ((m = extractRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    if (/EXTR_SKIP|EXTR_PREFIX_ALL/.test(l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "`extract()` of request data without EXTR_SKIP — attacker can overwrite arbitrary variables."
+    });
+  }
+  const parseRe = /\bparse_str\s*\(/g;
+  while ((m = parseRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "`parse_str()` of user input into the symbol table — variable injection."
+    });
+  }
+}
+function detectComplexBugs(code, file) {
+  const out = [];
+  detectDeserialization(code, file, out);
+  detectTypeJuggling(code, file, out);
+  detectMassAssignment(code, file, out);
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+var SOURCE_TOKENS2, MAGIC_METHODS;
+var init_complex_bugs = __esm(() => {
+  SOURCE_TOKENS2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data)|getParameter\(|req\.(query|body|params)/;
+  MAGIC_METHODS = /\b(__destruct|__wakeup|__toString|__invoke|__call|__get|__set|__isset|__unset|__sleep)\s*\(/;
+});
+
 // src/agents.ts
 import { readFileSync as readFileSync18 } from "node:fs";
 function emptyGraph() {
@@ -37218,6 +37336,7 @@ var init_agents = __esm(() => {
   init_eagle2();
   init_universal_taint();
   init_route_confusion();
+  init_complex_bugs();
   init_adapters();
   init_active();
   init_strike();
@@ -37324,6 +37443,21 @@ var init_agents = __esm(() => {
           graph = upsertNode(graph, nodeId, "route", { file: f, line: rc.line, type: rc.type, hypothesis: hyp.id });
           graph = addEdge2(graph, tid, nodeId, "routes_to");
         }
+        for (const cb of detectComplexBugs(code, f).slice(0, 50)) {
+          const hyp = makeHypothesis({
+            type: cb.category,
+            target: `${f}:${cb.line}`,
+            evidence: cb.detail,
+            confidence: cb.severity === "high" ? 0.7 : 0.55,
+            required_validation: "confirm the payload reaches the sink and is exploitable",
+            potential_impact: cb.type
+          });
+          hypotheses.push(hyp);
+          findings += 1;
+          const nodeId = `complex:${f}:${cb.line}:${cb.type}`;
+          graph = upsertNode(graph, nodeId, "vulnerability", { file: f, line: cb.line, type: cb.type, hypothesis: hyp.id });
+          graph = addEdge2(graph, tid, nodeId, "vulnerable_to");
+        }
       }
       return { ok: true, output: { files: files.length, findings }, hypotheses, graph };
     }
@@ -38267,6 +38401,13 @@ var init_enterprise_benchmark = __esm(() => {
       expected_vulns: 1,
       expected_sinks: ["Route confusion"],
       safe_tokens: []
+    },
+    {
+      id: "php-complex",
+      dir: join17(ROOT10, "php-complex"),
+      expected_vulns: 4,
+      expected_sinks: ["Deserialization", "Type juggling", "Mass assignment"],
+      safe_tokens: []
     }
   ];
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.62",
+  "version": "1.0.63",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {