blitzstrike 2.4.33 → 2.4.35

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.35] — 2026-09-14
+
+### Added — Variant Mining (confirm once, weaponize everywhere)
+
+- New `src/variant-scan.ts`: mass-scan an install base (plugin/theme/repo tree)
+  with ALL detectors (taint, complex-bugs incl. wrong-context sanitization +
+  missing authz/nonce, route-confusion) and report hits grouped by a DERIVED
+  signature (`<detector>:<type>`).
+- New `variant_scan` tool: pass `signature` to mine for ONE bug family — the
+  pattern that turns one confirmed CVE into hundreds of variants across 10k+
+  files.
+
+## [2.4.34] — 2026-09-14
+
+### Added — Framework Security Knowledge Graph (WordPress authz/nonce)
+
+- New `src/framework-security.ts`: WordPress security primitives encoded as DATA
+  (auth, nonce, entry-point hooks, sanitizers), exposed via `framework_knowledge`.
+- `detectMissingAuthz` (wired into `complex_scan`) finds missing capability /
+  nonce checks on WP entry points — `wp_ajax_*` / `wp_ajax_nopriv_*` /
+  `admin_post_*` / `register_rest_route` without `current_user_can`,
+  `wp_verify_nonce`, or `permission_callback` (auth bypass + CSRF + privesc,
+  the class that dominates real WordPress CVE reports).
+
 ## [2.4.33] — 2026-09-14
 
 ### Added — Security-State Lattice (beyond binary taint)

package/bench/corpus/cb-authz-safe.md

@@ -0,0 +1,15 @@
+- id: cb-authz-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+add_action('wp_ajax_delete_user', 'safe_handler');
+function safe_handler() {
+    check_ajax_referer('nonce');
+    if (!current_user_can('manage_options')) { wp_die('no'); }
+    $id = intval($_POST['id']);
+    $wpdb->query($wpdb->prepare("DELETE FROM users WHERE id=%d", $id));
+}
+```

package/bench/corpus/cb-authz-vuln.md

@@ -0,0 +1,13 @@
+- id: cb-authz-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+add_action('wp_ajax_nopriv_delete_user', 'delete_user_handler');
+function delete_user_handler() {
+    $id = $_POST['id'];
+    $wpdb->query("DELETE FROM users WHERE id=$id");
+}
+```

package/dist/index.js

@@ -15493,7 +15493,7 @@ async function checkMcpServers() {
 var init_mcp_status = () => {};
 
 // src/sync.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync20, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync21, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
 import { join as join19 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
@@ -15589,7 +15589,7 @@ function manualCopy(src, dst) {
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync8(d, readFileSync20(s));
+      writeFileSync8(d, readFileSync21(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
@@ -15640,7 +15640,7 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync22, existsSync as existsSync12 } from "node:fs";
+import { readFileSync as readFileSync23, existsSync as existsSync12 } from "node:fs";
 import { join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
@@ -15648,7 +15648,7 @@ function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync22(join20(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync23(join20(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -15689,13 +15689,13 @@ var init_release = __esm(() => {
 });
 
 // src/dependency.ts
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 import { join as join21 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync23(join21(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync24(join21(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -15722,7 +15722,7 @@ var init_dependency = __esm(() => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync24, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
+import { readFileSync as readFileSync25, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
 import { join as join22, dirname as dirname2 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
@@ -15833,7 +15833,7 @@ function resolveCommand() {
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync24(p, "utf8"));
+    return JSON.parse(readFileSync25(p, "utf8"));
   } catch {
     return null;
   }
@@ -15876,7 +15876,7 @@ function copyOpenCodeAgents() {
     const src = join22(srcDir, f);
     const dst = join22(dstDir, f);
     if (existsSync13(src)) {
-      writeFileSync9(dst, readFileSync24(src, "utf8"));
+      writeFileSync9(dst, readFileSync25(src, "utf8"));
     }
   }
 }
@@ -15885,7 +15885,7 @@ function codexWrite(p) {
     const dir = dirname2(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync24(p, "utf8") : "";
+    let existing = existsSync13(p) ? readFileSync25(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -15904,7 +15904,7 @@ function hermesWrite(p) {
     const dir = dirname2(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync24(p, "utf8") : "";
+    let existing = existsSync13(p) ? readFileSync25(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -30754,7 +30754,7 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
-import { readFileSync as readFileSync21 } from "node:fs";
+import { readFileSync as readFileSync22 } from "node:fs";
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -56259,6 +56259,177 @@ function detectWrongSanitizer(code, file) {
   });
 }
 
+// src/framework-security.ts
+var WP_PRIMITIVES = {
+  framework: "wordpress",
+  auth_primitives: [
+    "current_user_can",
+    "current_user_can_edit_post",
+    "current_user_can_for_blog",
+    "current_user_can_edit_others_posts",
+    "is_user_logged_in",
+    "authorize"
+  ],
+  nonce_primitives: [
+    "wp_verify_nonce",
+    "check_ajax_referer",
+    "check_admin_referer",
+    "verify_nonce"
+  ],
+  entry_point_hooks: [
+    "wp_ajax_",
+    "wp_ajax_nopriv_",
+    "admin_post_",
+    "admin_post_nopriv_",
+    "register_rest_route",
+    "add_shortcode",
+    "init",
+    "rest_api_init"
+  ],
+  sanitizers: [
+    "sanitize_text_field",
+    "esc_sql",
+    "esc_html",
+    "esc_attr",
+    "esc_url",
+    "wp_kses",
+    "wp_kses_post",
+    "absint",
+    "sanitize_email",
+    "sanitize_file_name"
+  ]
+};
+var FRAMEWORKS = {
+  wordpress: WP_PRIMITIVES,
+  wp: WP_PRIMITIVES
+};
+function frameworkKnowledge(framework = "wordpress") {
+  return FRAMEWORKS[framework.toLowerCase()] ?? null;
+}
+function functionBody(code, name) {
+  const idx = code.search(new RegExp(`function\\s+${name}\\s*\\(`));
+  if (idx === -1)
+    return null;
+  const open = code.indexOf("{", idx);
+  if (open === -1)
+    return null;
+  let depth = 0;
+  for (let i = open;i < code.length; i++) {
+    if (code[i] === "{")
+      depth++;
+    else if (code[i] === "}") {
+      depth--;
+      if (depth === 0)
+        return code.slice(open, i + 1);
+    }
+  }
+  return code.slice(open);
+}
+function lineNoOf(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+var INDIRECT_AUTH = /\b[a-zA-Z0-9_]*(auth|permission|cap|nonce|can_|check|verify|allow)[a-zA-Z0-9_]*\s*\(/;
+function detectMissingAuthz(code, file) {
+  const out = [];
+  const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
+  let m;
+  while ((m = ajaxRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = m[2];
+    const nopriv = hook.startsWith("wp_ajax_nopriv_");
+    const body = functionBody(code, handler);
+    if (!body)
+      continue;
+    const hasCap = /current_user_can|is_user_logged_in|authorize/.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/.test(body);
+    const line = lineNoOf(code, m.index);
+    if (nopriv && !hasCap) {
+      out.push({
+        file,
+        line,
+        type: "missing_authz",
+        category: "Missing capability check (unauthenticated AJAX handler)",
+        severity: "high",
+        evidence: `add_action('${hook}', '${handler}')`,
+        detail: `Unauthenticated AJAX handler '${handler}()' performs no current_user_can()/authorization check — any unauthenticated visitor can trigger it (auth bypass / privilege escalation).`
+      });
+    }
+    if (!hasNonce) {
+      out.push({
+        file,
+        line,
+        type: "missing_nonce",
+        category: "Missing nonce verification",
+        severity: "medium",
+        evidence: `add_action('${hook}', '${handler}')`,
+        detail: `AJAX handler '${handler}()' does not verify a nonce (wp_verify_nonce / check_ajax_referer) — CSRF: an attacker can force an authenticated admin to trigger it.`
+      });
+    }
+  }
+  const adminRe = /add_action\s*\(\s*['"](admin_post(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
+  while ((m = adminRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = m[2];
+    const nopriv = hook.startsWith("admin_post_nopriv_");
+    const body = functionBody(code, handler);
+    if (!body)
+      continue;
+    const hasCap = /current_user_can|is_user_logged_in|authorize/.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = /wp_verify_nonce|check_admin_referer|verify_nonce/.test(body);
+    const line = lineNoOf(code, m.index);
+    if (nopriv && !hasCap) {
+      out.push({
+        file,
+        line,
+        type: "missing_authz",
+        category: "Missing capability check (unauthenticated admin-post handler)",
+        severity: "high",
+        evidence: `add_action('${hook}', '${handler}')`,
+        detail: `Unauthenticated admin-post handler '${handler}()' has no authorization check — auth bypass / privilege escalation.`
+      });
+    }
+    if (!hasNonce) {
+      out.push({
+        file,
+        line,
+        type: "missing_nonce",
+        category: "Missing nonce verification",
+        severity: "medium",
+        evidence: `add_action('${hook}', '${handler}')`,
+        detail: `admin-post handler '${handler}()' does not verify a nonce — CSRF.`
+      });
+    }
+  }
+  const restRe = /register_rest_route\s*\(\s*['"]([^'"]+)['"]\s*,\s*['"]([^'"]+)['"]/g;
+  while ((m = restRe.exec(code)) !== null) {
+    const line = lineNoOf(code, m.index);
+    const window2 = code.slice(m.index, m.index + 800);
+    if (/permission_callback/.test(window2))
+      continue;
+    out.push({
+      file,
+      line,
+      type: "missing_authz",
+      category: "REST route missing permission_callback",
+      severity: "high",
+      evidence: `register_rest_route('${m[1]}', '${m[2]}')`,
+      detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass / unauthenticated data access or mutation).`
+    });
+  }
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+
 // src/complex-bugs.ts
 var SOURCE_TOKENS3 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data|body|headers|cookies|params)|getParameter\(|req\.(query|body|params|headers|cookies)/;
 function lines2(code) {
@@ -56371,6 +56542,7 @@ function detectComplexBugs(code, file) {
   detectXxe(code, file, out);
   detectSsti(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
+  out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
   return out.filter((f) => {
     const key = `${f.type}:${f.line}`;
@@ -56882,8 +57054,85 @@ function openCount() {
   return loadObligations().filter((o) => o.status === "open").length;
 }
 
+// src/variant-scan.ts
+init_scanner();
+import { readFileSync as readFileSync19 } from "node:fs";
+function deriveSignature(detector, type) {
+  return `${detector}:${type}`;
+}
+function variantScan(root, opts = {}) {
+  const files = iterSourceFiles(root, opts.maxFiles ?? 5000);
+  const hits = [];
+  for (const file of files) {
+    let code;
+    try {
+      code = readFileSync19(file, "utf8");
+    } catch {
+      continue;
+    }
+    try {
+      const taint = analyzeTaint(file);
+      for (const f of taint.findings) {
+        const type = f.category ?? f.sink ?? "taint";
+        hits.push({
+          file,
+          detector: "taint",
+          type,
+          signature: deriveSignature("taint", type),
+          line: f.sink_line ?? 0,
+          severity: "high",
+          evidence: f.sink ?? ""
+        });
+      }
+    } catch {}
+    for (const f of detectComplexBugs(code, file)) {
+      hits.push({
+        file,
+        detector: "complex_bugs",
+        type: f.type,
+        signature: deriveSignature("complex_bugs", f.type),
+        line: f.line,
+        severity: f.severity,
+        evidence: f.evidence
+      });
+    }
+    for (const f of detectRouteConfusion(code, file)) {
+      hits.push({
+        file,
+        detector: "route_confusion",
+        type: f.type,
+        signature: deriveSignature("route_confusion", f.type),
+        line: f.line,
+        severity: f.severity,
+        evidence: f.evidence
+      });
+    }
+  }
+  const bySignature = {};
+  for (const h of hits)
+    bySignature[h.signature] = (bySignature[h.signature] ?? 0) + 1;
+  const filtered = opts.signature ? hits.filter((h) => h.signature === opts.signature) : hits;
+  const filesWithFindings = new Set(filtered.map((h) => h.file));
+  return {
+    root,
+    files_scanned: files.length,
+    files_with_findings: filesWithFindings.size,
+    total_findings: filtered.length,
+    signature: opts.signature ?? null,
+    by_signature: bySignature,
+    hits: filtered.map((h) => ({
+      file: h.file,
+      detector: h.detector,
+      type: h.type,
+      signature: h.signature,
+      line: h.line,
+      severity: h.severity
+    }))
+  };
+}
+
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync11, readFileSync as readFileSync19, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
@@ -56925,7 +57174,7 @@ function detectFixture(dir) {
   for (const f of sourceFiles(dir)) {
     let code;
     try {
-      code = readFileSync19(f, "utf8");
+      code = readFileSync20(f, "utf8");
     } catch {
       continue;
     }
@@ -57826,6 +58075,27 @@ ${statusLine}` : statusLine },
     }
     return { content: [{ type: "text", text: JSON.stringify(analyzeSecurityState({ sanitizers: arr, sinkType: sink_type })) }] };
   });
+  server.registerTool("framework_knowledge", {
+    title: "Framework security knowledge graph",
+    description: "FRAMEWORK-KNOWLEDGE: return a framework's security primitives as data — authorization primitives (current_user_can, is_user_logged_in), nonce/CSRF primitives (wp_verify_nonce, check_ajax_referer), entry-point hooks (wp_ajax_*, admin_post_*, register_rest_route), and sanitizers. Powers the missing-authz/nonce detector. Extensible to other frameworks.",
+    inputSchema: {
+      framework: string2().optional().describe("Framework id (default 'wordpress')")
+    }
+  }, async ({ framework }) => {
+    const k = frameworkKnowledge(framework ?? "wordpress");
+    return { content: [{ type: "text", text: JSON.stringify(k ?? { error: "framework not in the knowledge graph", framework }) }] };
+  });
+  server.registerTool("variant_scan", {
+    title: "Mass variant-mining scan of an install base",
+    description: "VARIANT-MINING: mass-scan a source tree (plugin/theme/repo install base) with ALL detectors (taint, complex-bugs incl. wrong-context sanitization + missing authz/nonce, route-confusion) and report hits grouped by DERIVED signature (<detector>:<type>). Pass `signature` to mine for ONE bug family (e.g. complex_bugs:missing_authz) — the 'confirm once, weaponize everywhere' pattern that turns one CVE into hundreds of variants across an install base.",
+    inputSchema: {
+      root: string2().describe("Root directory to scan"),
+      max_files: number2().optional().describe("Max files to scan (default 5000)"),
+      signature: string2().optional().describe("Filter to one bug family (e.g. complex_bugs:missing_authz)")
+    }
+  }, async ({ root, max_files, signature }) => {
+    return { content: [{ type: "text", text: JSON.stringify(variantScan(root, { maxFiles: max_files, signature })) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",
@@ -58364,7 +58634,7 @@ ${statusLine}` : statusLine },
     description: "Route confusion (separate class from source→sink taint): detect attacker-controlled dispatch (call_user_func/forward/dispatch), dynamic method calls ($obj->$m()), dynamic include (LFI), batch/proxy forwarding without per-route auth re-check, and route matching without path normalization.",
     inputSchema: { path: string2().describe("Source file path (PHP)") }
   }, async ({ path }) => {
-    const code = readFileSync21(path, "utf8");
+    const code = readFileSync22(path, "utf8");
     const findings = detectRouteConfusion(code, path);
     return {
       content: [{
@@ -58374,11 +58644,11 @@ ${statusLine}` : statusLine },
     };
   });
   server.registerTool("complex_scan", {
-    title: "Complex-bug scan (deserialization / type juggling / mass assignment / prototype pollution / CRLF / path confusion / SSRF / XXE / SSTI / wrong-context sanitization)",
-    description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), and wrong-context sanitization (a value sanitized for context X reaching a sink that needs Y — e.g. sanitize_text_field() into a SQL query).",
+    title: "Complex-bug scan (deserialization / type juggling / mass assignment / prototype pollution / CRLF / path confusion / SSRF / XXE / SSTI / wrong-context sanitization / missing authz+nonce)",
+    description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), and missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
-    const code = readFileSync21(path, "utf8");
+    const code = readFileSync22(path, "utf8");
     const findings = detectComplexBugs(code, path);
     return {
       content: [{
@@ -58445,7 +58715,7 @@ ${statusLine}` : statusLine },
     let lang = language;
     if (path && !code) {
       try {
-        src = readFileSync21(path, "utf8");
+        src = readFileSync22(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
       }
@@ -58686,7 +58956,7 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync25, existsSync as existsSync14 } from "node:fs";
+import { readFileSync as readFileSync26, existsSync as existsSync14 } from "node:fs";
 import { join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 var ROOT11 = join23(fileURLToPath13(new URL(".", import.meta.url)), "..");
@@ -58694,7 +58964,7 @@ function readVersion() {
   try {
     const p = join23(ROOT11, "package.json");
     if (existsSync14(p))
-      return JSON.parse(readFileSync25(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync26(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.33",
+  "version": "2.4.35",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {