blitzstrike 2.4.105 → 2.4.107
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +35 -0
- package/dist/index.js +3471 -3302
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,41 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [2.4.107] — 2026-09-17
|
|
9
|
+
|
|
10
|
+
### Added — `review_harness` (per-file review, full-coverage deterministic rubric)
|
|
11
|
+
|
|
12
|
+
- New `review_harness(path)` tool implementing the "harness beats model"
|
|
13
|
+
discipline: applies a FIXED 5-signal rubric (entry_points / auth_gates /
|
|
14
|
+
sinks / secrets / logic_bugs) to EVERY enumerated source file and emits a
|
|
15
|
+
structured per-file verdict + a full-coverage report (files reviewed, clean vs
|
|
16
|
+
with-findings, per-class signal frequency). Guarantees no file is skipped and
|
|
17
|
+
every file is reviewed the same way — a COMPLETE map of the codebase, not a
|
|
18
|
+
partial scan. Most signal-dense files are sorted first.
|
|
19
|
+
|
|
20
|
+
### Fixed — scanner endpoint detection blanked string-embedded hooks
|
|
21
|
+
|
|
22
|
+
- `scanFile` matched endpoint hooks against `stripComments`, which blanks string
|
|
23
|
+
literals as well as comments — so `add_action('wp_ajax_nopriv_…')` /
|
|
24
|
+
`register_rest_route('…')` (always quoted) were never detected. Added
|
|
25
|
+
`stripCommentsOnly` (comments only, strings preserved) and matched endpoint
|
|
26
|
+
hooks against it; sinks still use the string-blanking strip. Regression-tested:
|
|
27
|
+
`wp_ajax_nopriv_` now detected.
|
|
28
|
+
|
|
29
|
+
## [2.4.106] — 2026-09-17
|
|
30
|
+
|
|
31
|
+
### Added — report assembly (metadata + vulnerability-location block)
|
|
32
|
+
|
|
33
|
+
- `reportMarkdown` now emits a `## 0. Report Metadata` table (Report ID,
|
|
34
|
+
Program/Scope, tool version, optional timestamp). The Report ID is DERIVED
|
|
35
|
+
deterministically (djb2 of title+scope → `BS-XXXXXX`) unless overridden via
|
|
36
|
+
`report_id`, so reports stay byte-reproducible.
|
|
37
|
+
- Added `param` + `method` to `FindingTarget`; each detailed finding now renders
|
|
38
|
+
a Vulnerability Location block (Affected URL, Endpoint, Parameter, Method)
|
|
39
|
+
alongside the existing Severity/CWE/Status/Confidence/Source/Sink/CVSS table —
|
|
40
|
+
matching the report-template structure (Executive Summary → Location →
|
|
41
|
+
Description → numbered Steps → Impact → Remediation → References).
|
|
42
|
+
|
|
8
43
|
## [2.4.105] — 2026-09-17
|
|
9
44
|
|
|
10
45
|
### Added — technique depth (concrete tools + payloads in the technique base)
|