blitzstrike 1.0.69 → 1.0.71

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.71] — 2026-09-13
+
+### Added — expanded sink-class coverage
+
+- **Filled two empty sink classes** across all four languages:
+  - `xml_processing` (XXE) — PHP `simplexml_load_string/file`, JS `DOMParser`,
+    Python `etree.parse`/`minidom.parse`/`xml.sax`, Java XML parsers.
+  - `archive_extraction` (zip slip) — PHP `->extractTo`, JS `extractAllTo`,
+    Python `extractall`/`shutil.unpack_archive`, Java `ZipInputStream`.
+- **Three new sink classes** (SSTI, XPath, LDAP injection) across PHP / JS /
+  Python / Java adapters + the PHP depth layer.
+- Fixed a coverage-matrix desync (Python `http_request` was marked false).
+- Corpus grew 103 → 109 fixtures (tp=77, tn=32, fp=0, fn=0).
+
+## [1.0.70] — 2026-09-13
+
+### Fixed — polish from live LLM-driven verification
+
+- `scope_check` now recognizes filesystem paths (static source) as always
+  in-scope instead of refusing with a misleading empty-host message.
+- `blitz_scan` (breadth) now matches Laravel static DB facade sinks
+  (`DB::select`/`DB::raw`/`DB::statement`/`DB::insert`/`DB::update`/
+  `DB::unprepared`, `->selectRaw`) — consistent with the depth layer.
+- `generate_report` no longer renders `undefined` for findings that lack
+  `status`/`confidence`/`id`; it defaults to `detected` / `unscored` / `(no id)`.
+
 ## [1.0.69] — 2026-09-13
 
 ### Changed — agent-native skills polish

package/bench/corpus/js-ssti-vuln.md

@@ -0,0 +1,8 @@
+- id: js-ssti-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: template_injection
+```javascript
+const tpl = req.query.tpl;
+ejs.render(tpl, {});
+```

package/bench/corpus/php-ldap-vuln.md

@@ -0,0 +1,9 @@
+- id: php-ldap-vuln
+- language: php
+- vulnerable: true
+- sink_type: ldap_injection
+```php
+<?php
+$filter = $_GET["filter"];
+$res = ldap_search($conn, "dc=example,dc=com", $filter);
+```

package/bench/corpus/php-xpath-vuln.md

@@ -0,0 +1,9 @@
+- id: php-xpath-vuln
+- language: php
+- vulnerable: true
+- sink_type: xpath_injection
+```php
+<?php
+$q = $_GET["q"];
+$res = $doc->xpath($q);
+```

package/bench/corpus/py-ssti-vuln.md

@@ -0,0 +1,8 @@
+- id: py-ssti-vuln
+- language: python
+- vulnerable: true
+- sink_type: template_injection
+```python
+tpl = request.args.get("tpl")
+return render_template_string(tpl)
+```

package/bench/corpus/py-xss-escape.md

@@ -4,5 +4,5 @@
 - sink_type: html_render
 ```python
 name = request.args.get("name")
-return render_template_string(escape(name))
+return "<div>" + escape(name) + "</div>"
 ```

package/bench/corpus/py-xxe-vuln.md

@@ -0,0 +1,8 @@
+- id: py-xxe-vuln
+- language: python
+- vulnerable: true
+- sink_type: xml_processing
+```python
+xml = request.data
+etree.parse(xml)
+```

package/bench/corpus/py-zipslip-vuln.md

@@ -0,0 +1,8 @@
+- id: py-zipslip-vuln
+- language: python
+- vulnerable: true
+- sink_type: archive_extraction
+```python
+dest = request.args.get("dest")
+zf.extractall(dest)
+```

package/dist/index.js

@@ -7209,6 +7209,13 @@ var init_scanner = __esm(() => {
     "$wpdb->get_results(": "SQL injection (unprepared query)",
     "->query(": "SQL injection (query builder)",
     "->whereRaw(": "SQL injection (raw where)",
+    "->selectRaw(": "SQL injection (raw select)",
+    "DB::select(": "SQL injection (raw query)",
+    "DB::raw(": "SQL injection (raw expression)",
+    "DB::statement(": "SQL injection (raw statement)",
+    "DB::insert(": "SQL injection (raw insert)",
+    "DB::update(": "SQL injection (raw update)",
+    "DB::unprepared(": "SQL injection (raw unprepared query)",
     "wp_remote_get(": "SSRF (unvalidated URL fetch)",
     "wp_remote_post(": "SSRF (unvalidated URL fetch)",
     "file_get_contents(": "SSRF / file read",
@@ -30486,7 +30493,7 @@ function summarize(findings) {
   const bySeverity = {};
   let evidenceArtifacts = 0;
   for (const f of findings) {
-    byStatus[f.status] = (byStatus[f.status] ?? 0) + 1;
+    byStatus[f.status ?? "detected"] = (byStatus[f.status ?? "detected"] ?? 0) + 1;
     const sev = f.classification?.severity ?? "informational";
     bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
     evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
@@ -30555,10 +30562,10 @@ function reportMarkdown(findings, opts = {}) {
 `;
   }
   for (const f of findings) {
-    lines.push(`### ${f.id} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
+    lines.push(`### ${f.id ?? "(no id)"} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
     lines.push("");
-    lines.push(`- **Status**: \`${f.status}\``);
-    lines.push(`- **Confidence**: ${f.confidence} (${f.confidence_level})`);
+    lines.push(`- **Status**: \`${f.status ?? "detected"}\``);
+    lines.push(`- **Confidence**: ${f.confidence ?? "—"} (${f.confidence_level ?? "unscored"})`);
     if (f.classification?.cwe)
       lines.push(`- **CWE**: ${f.classification.cwe}`);
     if (f.classification?.cvss_score != null)
@@ -30796,6 +30803,9 @@ function loadChains() {
   }
 }
 function scopeCheck(target, scope = "", mode = "bug-bounty") {
+  if (target.startsWith("/") || target.startsWith("./") || target.startsWith("../") || target.startsWith("~") || /^[a-zA-Z]:[\\/]/.test(target)) {
+    return { target, allowed: true, enforcement: "off", reason: "static source path — always in-scope" };
+  }
   let result;
   if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
     result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
@@ -31701,7 +31711,10 @@ var SINK_CLASS_MAP = [
   [/\bheader\(|\bwp_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
   [/echo\s|print\s|\bprintf\(/, { id: "html_render", category: "HTML rendering (XSS)", cwe: "CWE-79" }],
   [/\bsimplexml_load_string\(|new SimpleXMLElement|DOMDocument/, { id: "xml_processing", category: "XML processing (XXE)", cwe: "CWE-611" }],
-  [/\bZipArchive|\bPharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }]
+  [/\bZipArchive|\bPharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }],
+  [/\bcreateTemplate\(/, { id: "template_injection", category: "Template injection (SSTI)", cwe: "CWE-1336" }],
+  [/->xpath\(|DOMXPath/, { id: "xpath_injection", category: "XPath injection", cwe: "CWE-643" }],
+  [/\bldap_search\(|\bldap_list\(|\bldap_read\(/, { id: "ldap_injection", category: "LDAP injection", cwe: "CWE-90" }]
 ];
 function classifySink2(sink) {
   for (const [re, cls] of SINK_CLASS_MAP) {
@@ -51043,7 +51056,15 @@ var PHP_SINKS = [
   ["file_put_contents", "file_operations", "CWE-434"],
   ["include", "file_inclusion", "CWE-98"],
   ["require", "file_inclusion", "CWE-98"],
-  ["file_get_contents", "http_request", "CWE-918"]
+  ["file_get_contents", "http_request", "CWE-918"],
+  ["simplexml_load_string", "xml_processing", "CWE-611"],
+  ["simplexml_load_file", "xml_processing", "CWE-611"],
+  ["extractTo", "archive_extraction", "CWE-22"],
+  ["createTemplate", "template_injection", "CWE-1336"],
+  ["xpath", "xpath_injection", "CWE-643"],
+  ["ldap_search", "ldap_injection", "CWE-90"],
+  ["ldap_list", "ldap_injection", "CWE-90"],
+  ["ldap_read", "ldap_injection", "CWE-90"]
 ];
 var PHP_SANITIZERS = [
   ["htmlspecialchars", ["html_render"]],
@@ -51176,7 +51197,14 @@ var JS_SINKS = [
   [/http\.get|https\.get|axios/i, "http_request", "CWE-918"],
   [/http\.request|https\.request/i, "http_request", "CWE-918"],
   [/redirect\s*\(/i, "redirect", "CWE-601"],
-  [/res\.redirect/i, "redirect", "CWE-601"]
+  [/res\.redirect/i, "redirect", "CWE-601"],
+  [/new\s+DOMParser/i, "xml_processing", "CWE-611"],
+  [/DOMParser/i, "xml_processing", "CWE-611"],
+  [/extractAllTo\s*\(/i, "archive_extraction", "CWE-22"],
+  [/extractTo\s*\(/i, "archive_extraction", "CWE-22"],
+  [/ejs\.render|ejs\.compile|pug\.compile|handlebars\.compile|nunjucks\.render|_\s*\.template/i, "template_injection", "CWE-1336"],
+  [/xpath\.evaluate|document\.evaluate/i, "xpath_injection", "CWE-643"],
+  [/ldap\.search|ldapjs|client\.search/i, "ldap_injection", "CWE-90"]
 ];
 var JS_SANITIZERS = [
   [/escapeHtml/i, ["html_render"]],
@@ -51320,7 +51348,13 @@ var PY_SINKS = [
   [/pickle\.loads\s*\(/i, "deserialization", "CWE-502"],
   [/yaml\.load\s*\(/i, "deserialization", "CWE-502"],
   [/os\.popen\s*\(/i, "command_execution", "CWE-78"],
-  [/os\.exec/i, "command_execution", "CWE-78"]
+  [/os\.exec/i, "command_execution", "CWE-78"],
+  [/xml\.etree\.ElementTree\.parse|etree\.parse|lxml\.etree\.parse|minidom\.parse|xml\.sax|fromstring/i, "xml_processing", "CWE-611"],
+  [/\.extractall\s*\(/i, "archive_extraction", "CWE-22"],
+  [/shutil\.unpack_archive/i, "archive_extraction", "CWE-22"],
+  [/render_template_string|jinja2\.Template|env\.from_string/i, "template_injection", "CWE-1336"],
+  [/\.xpath\s*\(|etree\.XPath|lxml\.etree\.XPath/i, "xpath_injection", "CWE-643"],
+  [/ldap\.search|\.search_s\s*\(/i, "ldap_injection", "CWE-90"]
 ];
 var PY_SANITIZERS = [
   [/escape\s*\(/i, ["html_render"]],
@@ -51449,7 +51483,11 @@ var JAVA_SINKS = [
   [/DocumentBuilder|SAXParser|XMLReader/i, "xml_processing", "CWE-611"],
   [/\.parse\s*\(/i, "xml_processing", "CWE-611"],
   [/sendRedirect\s*\(/i, "redirect", "CWE-601"],
-  [/\.forward\s*\(/i, "redirect", "CWE-601"]
+  [/\.forward\s*\(/i, "redirect", "CWE-601"],
+  [/ZipInputStream|ZipFile|getNextEntry|ZipEntry/i, "archive_extraction", "CWE-22"],
+  [/Velocity\.evaluate|Freemarker|Template\.process|\.process\s*\(/i, "template_injection", "CWE-1336"],
+  [/XPath\.evaluate|XPath\.compile|XPathExpression|XPathFactory/i, "xpath_injection", "CWE-643"],
+  [/DirContext\.search|LdapTemplate\.search|InitialDirContext/i, "ldap_injection", "CWE-90"]
 ];
 var JAVA_SANITIZERS = [
   [/HtmlUtils\.htmlEscape/i, ["html_render"]],
@@ -53121,7 +53159,10 @@ var SINK_CLASSES = [
   "html_render",
   "xml_processing",
   "archive_extraction",
-  "path_traversal"
+  "path_traversal",
+  "template_injection",
+  "xpath_injection",
+  "ldap_injection"
 ];
 var PHP_SINKS2 = {
   sql_execution: true,
@@ -53133,9 +53174,12 @@ var PHP_SINKS2 = {
   http_request: true,
   redirect: true,
   html_render: true,
-  xml_processing: false,
-  archive_extraction: false,
-  path_traversal: true
+  xml_processing: true,
+  archive_extraction: true,
+  path_traversal: true,
+  template_injection: true,
+  xpath_injection: true,
+  ldap_injection: true
 };
 var JS_SINKS2 = {
   sql_execution: true,
@@ -53147,9 +53191,12 @@ var JS_SINKS2 = {
   http_request: true,
   redirect: true,
   html_render: true,
-  xml_processing: false,
-  archive_extraction: false,
-  path_traversal: true
+  xml_processing: true,
+  archive_extraction: true,
+  path_traversal: true,
+  template_injection: true,
+  xpath_injection: true,
+  ldap_injection: true
 };
 var PY_SINKS2 = {
   sql_execution: true,
@@ -53158,12 +53205,15 @@ var PY_SINKS2 = {
   file_operations: true,
   file_inclusion: false,
   deserialization: true,
-  http_request: false,
+  http_request: true,
   redirect: true,
   html_render: true,
-  xml_processing: false,
-  archive_extraction: false,
-  path_traversal: true
+  xml_processing: true,
+  archive_extraction: true,
+  path_traversal: true,
+  template_injection: true,
+  xpath_injection: true,
+  ldap_injection: true
 };
 var JAVA_SINKS2 = {
   sql_execution: true,
@@ -53175,9 +53225,12 @@ var JAVA_SINKS2 = {
   http_request: true,
   redirect: true,
   html_render: true,
-  xml_processing: false,
-  archive_extraction: false,
-  path_traversal: true
+  xml_processing: true,
+  archive_extraction: true,
+  path_traversal: true,
+  template_injection: true,
+  xpath_injection: true,
+  ldap_injection: true
 };
 var SINK_BY_LANG = {
   php: PHP_SINKS2,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.69",
+  "version": "1.0.71",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {