blitzstrike 2.4.33 → 2.4.34

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.34] — 2026-09-14
+
+### Added — Framework Security Knowledge Graph (WordPress authz/nonce)
+
+- New `src/framework-security.ts`: WordPress security primitives encoded as DATA
+  (auth, nonce, entry-point hooks, sanitizers), exposed via `framework_knowledge`.
+- `detectMissingAuthz` (wired into `complex_scan`) finds missing capability /
+  nonce checks on WP entry points — `wp_ajax_*` / `wp_ajax_nopriv_*` /
+  `admin_post_*` / `register_rest_route` without `current_user_can`,
+  `wp_verify_nonce`, or `permission_callback` (auth bypass + CSRF + privesc,
+  the class that dominates real WordPress CVE reports).
+
 ## [2.4.33] — 2026-09-14
 
 ### Added — Security-State Lattice (beyond binary taint)

package/bench/corpus/cb-authz-safe.md

@@ -0,0 +1,15 @@
+- id: cb-authz-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+add_action('wp_ajax_delete_user', 'safe_handler');
+function safe_handler() {
+    check_ajax_referer('nonce');
+    if (!current_user_can('manage_options')) { wp_die('no'); }
+    $id = intval($_POST['id']);
+    $wpdb->query($wpdb->prepare("DELETE FROM users WHERE id=%d", $id));
+}
+```

package/bench/corpus/cb-authz-vuln.md

@@ -0,0 +1,13 @@
+- id: cb-authz-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+add_action('wp_ajax_nopriv_delete_user', 'delete_user_handler');
+function delete_user_handler() {
+    $id = $_POST['id'];
+    $wpdb->query("DELETE FROM users WHERE id=$id");
+}
+```

package/dist/index.js

@@ -56259,6 +56259,177 @@ function detectWrongSanitizer(code, file) {
   });
 }
 
+// src/framework-security.ts
+var WP_PRIMITIVES = {
+  framework: "wordpress",
+  auth_primitives: [
+    "current_user_can",
+    "current_user_can_edit_post",
+    "current_user_can_for_blog",
+    "current_user_can_edit_others_posts",
+    "is_user_logged_in",
+    "authorize"
+  ],
+  nonce_primitives: [
+    "wp_verify_nonce",
+    "check_ajax_referer",
+    "check_admin_referer",
+    "verify_nonce"
+  ],
+  entry_point_hooks: [
+    "wp_ajax_",
+    "wp_ajax_nopriv_",
+    "admin_post_",
+    "admin_post_nopriv_",
+    "register_rest_route",
+    "add_shortcode",
+    "init",
+    "rest_api_init"
+  ],
+  sanitizers: [
+    "sanitize_text_field",
+    "esc_sql",
+    "esc_html",
+    "esc_attr",
+    "esc_url",
+    "wp_kses",
+    "wp_kses_post",
+    "absint",
+    "sanitize_email",
+    "sanitize_file_name"
+  ]
+};
+var FRAMEWORKS = {
+  wordpress: WP_PRIMITIVES,
+  wp: WP_PRIMITIVES
+};
+function frameworkKnowledge(framework = "wordpress") {
+  return FRAMEWORKS[framework.toLowerCase()] ?? null;
+}
+function functionBody(code, name) {
+  const idx = code.search(new RegExp(`function\\s+${name}\\s*\\(`));
+  if (idx === -1)
+    return null;
+  const open = code.indexOf("{", idx);
+  if (open === -1)
+    return null;
+  let depth = 0;
+  for (let i = open;i < code.length; i++) {
+    if (code[i] === "{")
+      depth++;
+    else if (code[i] === "}") {
+      depth--;
+      if (depth === 0)
+        return code.slice(open, i + 1);
+    }
+  }
+  return code.slice(open);
+}
+function lineNoOf(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+var INDIRECT_AUTH = /\b[a-zA-Z0-9_]*(auth|permission|cap|nonce|can_|check|verify|allow)[a-zA-Z0-9_]*\s*\(/;
+function detectMissingAuthz(code, file) {
+  const out = [];
+  const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
+  let m;
+  while ((m = ajaxRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = m[2];
+    const nopriv = hook.startsWith("wp_ajax_nopriv_");
+    const body = functionBody(code, handler);
+    if (!body)
+      continue;
+    const hasCap = /current_user_can|is_user_logged_in|authorize/.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/.test(body);
+    const line = lineNoOf(code, m.index);
+    if (nopriv && !hasCap) {
+      out.push({
+        file,
+        line,
+        type: "missing_authz",
+        category: "Missing capability check (unauthenticated AJAX handler)",
+        severity: "high",
+        evidence: `add_action('${hook}', '${handler}')`,
+        detail: `Unauthenticated AJAX handler '${handler}()' performs no current_user_can()/authorization check — any unauthenticated visitor can trigger it (auth bypass / privilege escalation).`
+      });
+    }
+    if (!hasNonce) {
+      out.push({
+        file,
+        line,
+        type: "missing_nonce",
+        category: "Missing nonce verification",
+        severity: "medium",
+        evidence: `add_action('${hook}', '${handler}')`,
+        detail: `AJAX handler '${handler}()' does not verify a nonce (wp_verify_nonce / check_ajax_referer) — CSRF: an attacker can force an authenticated admin to trigger it.`
+      });
+    }
+  }
+  const adminRe = /add_action\s*\(\s*['"](admin_post(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
+  while ((m = adminRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = m[2];
+    const nopriv = hook.startsWith("admin_post_nopriv_");
+    const body = functionBody(code, handler);
+    if (!body)
+      continue;
+    const hasCap = /current_user_can|is_user_logged_in|authorize/.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = /wp_verify_nonce|check_admin_referer|verify_nonce/.test(body);
+    const line = lineNoOf(code, m.index);
+    if (nopriv && !hasCap) {
+      out.push({
+        file,
+        line,
+        type: "missing_authz",
+        category: "Missing capability check (unauthenticated admin-post handler)",
+        severity: "high",
+        evidence: `add_action('${hook}', '${handler}')`,
+        detail: `Unauthenticated admin-post handler '${handler}()' has no authorization check — auth bypass / privilege escalation.`
+      });
+    }
+    if (!hasNonce) {
+      out.push({
+        file,
+        line,
+        type: "missing_nonce",
+        category: "Missing nonce verification",
+        severity: "medium",
+        evidence: `add_action('${hook}', '${handler}')`,
+        detail: `admin-post handler '${handler}()' does not verify a nonce — CSRF.`
+      });
+    }
+  }
+  const restRe = /register_rest_route\s*\(\s*['"]([^'"]+)['"]\s*,\s*['"]([^'"]+)['"]/g;
+  while ((m = restRe.exec(code)) !== null) {
+    const line = lineNoOf(code, m.index);
+    const window2 = code.slice(m.index, m.index + 800);
+    if (/permission_callback/.test(window2))
+      continue;
+    out.push({
+      file,
+      line,
+      type: "missing_authz",
+      category: "REST route missing permission_callback",
+      severity: "high",
+      evidence: `register_rest_route('${m[1]}', '${m[2]}')`,
+      detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass / unauthenticated data access or mutation).`
+    });
+  }
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+
 // src/complex-bugs.ts
 var SOURCE_TOKENS3 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data|body|headers|cookies|params)|getParameter\(|req\.(query|body|params|headers|cookies)/;
 function lines2(code) {
@@ -56371,6 +56542,7 @@ function detectComplexBugs(code, file) {
   detectXxe(code, file, out);
   detectSsti(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
+  out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
   return out.filter((f) => {
     const key = `${f.type}:${f.line}`;
@@ -57826,6 +57998,16 @@ ${statusLine}` : statusLine },
     }
     return { content: [{ type: "text", text: JSON.stringify(analyzeSecurityState({ sanitizers: arr, sinkType: sink_type })) }] };
   });
+  server.registerTool("framework_knowledge", {
+    title: "Framework security knowledge graph",
+    description: "FRAMEWORK-KNOWLEDGE: return a framework's security primitives as data — authorization primitives (current_user_can, is_user_logged_in), nonce/CSRF primitives (wp_verify_nonce, check_ajax_referer), entry-point hooks (wp_ajax_*, admin_post_*, register_rest_route), and sanitizers. Powers the missing-authz/nonce detector. Extensible to other frameworks.",
+    inputSchema: {
+      framework: string2().optional().describe("Framework id (default 'wordpress')")
+    }
+  }, async ({ framework }) => {
+    const k = frameworkKnowledge(framework ?? "wordpress");
+    return { content: [{ type: "text", text: JSON.stringify(k ?? { error: "framework not in the knowledge graph", framework }) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",
@@ -58374,8 +58556,8 @@ ${statusLine}` : statusLine },
     };
   });
   server.registerTool("complex_scan", {
-    title: "Complex-bug scan (deserialization / type juggling / mass assignment / prototype pollution / CRLF / path confusion / SSRF / XXE / SSTI / wrong-context sanitization)",
-    description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), and wrong-context sanitization (a value sanitized for context X reaching a sink that needs Y — e.g. sanitize_text_field() into a SQL query).",
+    title: "Complex-bug scan (deserialization / type juggling / mass assignment / prototype pollution / CRLF / path confusion / SSRF / XXE / SSTI / wrong-context sanitization / missing authz+nonce)",
+    description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), and missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
     const code = readFileSync21(path, "utf8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.33",
+  "version": "2.4.34",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {