blitzstrike 2.4.34 → 2.4.36

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.36] — 2026-09-14
+
+### Changed — Framework Knowledge Graph is now MULTI-framework (not WordPress-only)
+
+- `framework-security.ts` now covers 9 frameworks: WordPress, Laravel, Django,
+  Flask, Express, Spring, Symfony, ASP.NET Core, Ruby on Rails — each with its
+  auth / nonce / entry-point / sanitizer primitives as data.
+- `detectMissingAuthz` now detects missing authorization across ALL frameworks
+  (route middleware, decorators, annotations), not just WP AJAX/REST hooks.
+- `framework_knowledge` tool returns the framework list on an unknown id.
+
+## [2.4.35] — 2026-09-14
+
+### Added — Variant Mining (confirm once, weaponize everywhere)
+
+- New `src/variant-scan.ts`: mass-scan an install base (plugin/theme/repo tree)
+  with ALL detectors (taint, complex-bugs incl. wrong-context sanitization +
+  missing authz/nonce, route-confusion) and report hits grouped by a DERIVED
+  signature (`<detector>:<type>`).
+- New `variant_scan` tool: pass `signature` to mine for ONE bug family — the
+  pattern that turns one confirmed CVE into hundreds of variants across 10k+
+  files.
+
 ## [2.4.34] — 2026-09-14
 
 ### Added — Framework Security Knowledge Graph (WordPress authz/nonce)

package/dist/index.js

@@ -15493,7 +15493,7 @@ async function checkMcpServers() {
 var init_mcp_status = () => {};
 
 // src/sync.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync20, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync21, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
 import { join as join19 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
@@ -15589,7 +15589,7 @@ function manualCopy(src, dst) {
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync8(d, readFileSync20(s));
+      writeFileSync8(d, readFileSync21(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
@@ -15640,7 +15640,7 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync22, existsSync as existsSync12 } from "node:fs";
+import { readFileSync as readFileSync23, existsSync as existsSync12 } from "node:fs";
 import { join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
@@ -15648,7 +15648,7 @@ function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync22(join20(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync23(join20(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -15689,13 +15689,13 @@ var init_release = __esm(() => {
 });
 
 // src/dependency.ts
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 import { join as join21 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync23(join21(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync24(join21(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -15722,7 +15722,7 @@ var init_dependency = __esm(() => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync24, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
+import { readFileSync as readFileSync25, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
 import { join as join22, dirname as dirname2 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
@@ -15833,7 +15833,7 @@ function resolveCommand() {
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync24(p, "utf8"));
+    return JSON.parse(readFileSync25(p, "utf8"));
   } catch {
     return null;
   }
@@ -15876,7 +15876,7 @@ function copyOpenCodeAgents() {
     const src = join22(srcDir, f);
     const dst = join22(dstDir, f);
     if (existsSync13(src)) {
-      writeFileSync9(dst, readFileSync24(src, "utf8"));
+      writeFileSync9(dst, readFileSync25(src, "utf8"));
     }
   }
 }
@@ -15885,7 +15885,7 @@ function codexWrite(p) {
     const dir = dirname2(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync24(p, "utf8") : "";
+    let existing = existsSync13(p) ? readFileSync25(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -15904,7 +15904,7 @@ function hermesWrite(p) {
     const dir = dirname2(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync24(p, "utf8") : "";
+    let existing = existsSync13(p) ? readFileSync25(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -30754,7 +30754,7 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
-import { readFileSync as readFileSync21 } from "node:fs";
+import { readFileSync as readFileSync22 } from "node:fs";
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -56260,52 +56260,94 @@ function detectWrongSanitizer(code, file) {
 }
 
 // src/framework-security.ts
-var WP_PRIMITIVES = {
-  framework: "wordpress",
-  auth_primitives: [
-    "current_user_can",
-    "current_user_can_edit_post",
-    "current_user_can_for_blog",
-    "current_user_can_edit_others_posts",
-    "is_user_logged_in",
-    "authorize"
-  ],
-  nonce_primitives: [
-    "wp_verify_nonce",
-    "check_ajax_referer",
-    "check_admin_referer",
-    "verify_nonce"
-  ],
-  entry_point_hooks: [
-    "wp_ajax_",
-    "wp_ajax_nopriv_",
-    "admin_post_",
-    "admin_post_nopriv_",
-    "register_rest_route",
-    "add_shortcode",
-    "init",
-    "rest_api_init"
-  ],
-  sanitizers: [
-    "sanitize_text_field",
-    "esc_sql",
-    "esc_html",
-    "esc_attr",
-    "esc_url",
-    "wp_kses",
-    "wp_kses_post",
-    "absint",
-    "sanitize_email",
-    "sanitize_file_name"
-  ]
-};
 var FRAMEWORKS = {
-  wordpress: WP_PRIMITIVES,
-  wp: WP_PRIMITIVES
+  wordpress: {
+    framework: "wordpress",
+    auth_primitives: ["current_user_can", "current_user_can_edit_post", "is_user_logged_in", "authorize"],
+    nonce_primitives: ["wp_verify_nonce", "check_ajax_referer", "check_admin_referer", "verify_nonce"],
+    entry_point_hooks: ["wp_ajax_", "wp_ajax_nopriv_", "admin_post_", "admin_post_nopriv_", "register_rest_route", "add_shortcode", "init", "rest_api_init"],
+    sanitizers: ["sanitize_text_field", "esc_sql", "esc_html", "esc_attr", "esc_url", "wp_kses", "wp_kses_post", "absint", "sanitize_email", "sanitize_file_name"]
+  },
+  wp: {
+    framework: "wordpress",
+    auth_primitives: ["current_user_can", "is_user_logged_in", "authorize"],
+    nonce_primitives: ["wp_verify_nonce", "check_ajax_referer", "check_admin_referer"],
+    entry_point_hooks: ["wp_ajax_", "wp_ajax_nopriv_", "register_rest_route"],
+    sanitizers: ["sanitize_text_field", "esc_sql", "esc_html", "absint"]
+  },
+  laravel: {
+    framework: "laravel",
+    auth_primitives: ["auth", "authorize", "Gate::", "can:", "->middleware('auth'", "->can(", "$this->authorize", "@can", "@cannot", "policy"],
+    nonce_primitives: ["@csrf", "csrf_field", "VerifyCsrfToken"],
+    entry_point_hooks: ["Route::get", "Route::post", "Route::put", "Route::delete", "Route::resource", "Route::match"],
+    sanitizers: ["e(", "htmlspecialchars", "clean(", "strip_tags"]
+  },
+  django: {
+    framework: "django",
+    auth_primitives: ["login_required", "permission_required", "user_passes_test", "LoginRequiredMixin", "PermissionRequiredMixin", "permission_classes", "IsAuthenticated", "has_permission"],
+    nonce_primitives: ["csrf_protect", "CsrfViewMiddleware", "@csrf"],
+    entry_point_hooks: ["def ", "@api_view", "path(", "url(", "re_path("],
+    sanitizers: ["escape(", "mark_safe", "html.escape"]
+  },
+  flask: {
+    framework: "flask",
+    auth_primitives: ["login_required", "@login_required", "current_user.is_authenticated", "permission_required"],
+    nonce_primitives: ["CSRFProtect", "csrf_token"],
+    entry_point_hooks: ["@app.route", "@blueprint.route", "@bp.route"],
+    sanitizers: ["escape(", "Markup", "html.escape"]
+  },
+  express: {
+    framework: "express",
+    auth_primitives: ["requireAuth", "authenticate", "passport.authenticate", "req.user", "isAuthenticated", "ensureAuthenticated", "requireLogin", "authorize", "authMiddleware"],
+    nonce_primitives: ["csurf", "csrfProtection", "helmet"],
+    entry_point_hooks: ["app.get", "app.post", "router.get", "router.post"],
+    sanitizers: ["escapeHtml", "encodeURIComponent", "sanitize", "xss"]
+  },
+  spring: {
+    framework: "spring",
+    auth_primitives: ["@PreAuthorize", "@Secured", "@RolesAllowed", "hasRole", "hasAuthority", "isAuthenticated", "SecurityContextHolder"],
+    nonce_primitives: ["csrf", "CsrfToken"],
+    entry_point_hooks: ["@GetMapping", "@PostMapping", "@RequestMapping", "@Controller"],
+    sanitizers: ["HtmlUtils.htmlEscape", "escapeHtml", "StringEscapeUtils"]
+  },
+  symfony: {
+    framework: "symfony",
+    auth_primitives: ["is_granted", "denyAccessUnlessGranted", "->isGranted(", "IsGranted", "Voter"],
+    nonce_primitives: ["isCsrfTokenValid", "csrf_token"],
+    entry_point_hooks: ["#[Route", "@Route", "#[Get", "#[Post"],
+    sanitizers: ["e(", "htmlspecialchars", "escape("]
+  },
+  aspnet: {
+    framework: "aspnet",
+    auth_primitives: ["[Authorize", "[AllowAnonymous", "User.Identity", "IsInRole", "AuthorizeAsync", "IAuthorizationService"],
+    nonce_primitives: ["ValidateAntiForgeryToken", "Antiforgery"],
+    entry_point_hooks: ["[HttpGet", "[HttpPost", "[Route("],
+    sanitizers: ["HtmlEncoder", "Html.Raw", "UrlEncoder"]
+  },
+  rails: {
+    framework: "rails",
+    auth_primitives: ["authenticate_user!", "authorize", "before_action :authenticate", "before_action :authorize", "current_user"],
+    nonce_primitives: ["protect_from_forgery", "form_authenticity_token"],
+    entry_point_hooks: ["def ", "before_action"],
+    sanitizers: ["h(", "html_escape", "sanitize"]
+  }
 };
 function frameworkKnowledge(framework = "wordpress") {
   return FRAMEWORKS[framework.toLowerCase()] ?? null;
 }
+function listFrameworks2() {
+  const s = new Set;
+  for (const k of Object.keys(FRAMEWORKS))
+    s.add(FRAMEWORKS[k].framework);
+  return [...s];
+}
+function lineNoOf(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
 function functionBody(code, name) {
   const idx = code.search(new RegExp(`function\\s+${name}\\s*\\(`));
   if (idx === -1)
@@ -56325,16 +56367,8 @@ function functionBody(code, name) {
   }
   return code.slice(open);
 }
-function lineNoOf(code, pos) {
-  let n = 1;
-  for (let i = 0;i < pos; i++)
-    if (code.charCodeAt(i) === 10)
-      n++;
-  return n;
-}
 var INDIRECT_AUTH = /\b[a-zA-Z0-9_]*(auth|permission|cap|nonce|can_|check|verify|allow)[a-zA-Z0-9_]*\s*\(/;
-function detectMissingAuthz(code, file) {
-  const out = [];
+function detectWpAuthz(code, file, out) {
   const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
   let m;
   while ((m = ajaxRe.exec(code)) !== null) {
@@ -56348,26 +56382,10 @@ function detectMissingAuthz(code, file) {
     const hasNonce = /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/.test(body);
     const line = lineNoOf(code, m.index);
     if (nopriv && !hasCap) {
-      out.push({
-        file,
-        line,
-        type: "missing_authz",
-        category: "Missing capability check (unauthenticated AJAX handler)",
-        severity: "high",
-        evidence: `add_action('${hook}', '${handler}')`,
-        detail: `Unauthenticated AJAX handler '${handler}()' performs no current_user_can()/authorization check — any unauthenticated visitor can trigger it (auth bypass / privilege escalation).`
-      });
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated AJAX handler)", severity: "high", evidence: `add_action('${hook}', '${handler}')`, detail: `Unauthenticated AJAX handler '${handler}()' performs no current_user_can()/authorization check — any unauthenticated visitor can trigger it (auth bypass / privilege escalation).` });
     }
     if (!hasNonce) {
-      out.push({
-        file,
-        line,
-        type: "missing_nonce",
-        category: "Missing nonce verification",
-        severity: "medium",
-        evidence: `add_action('${hook}', '${handler}')`,
-        detail: `AJAX handler '${handler}()' does not verify a nonce (wp_verify_nonce / check_ajax_referer) — CSRF: an attacker can force an authenticated admin to trigger it.`
-      });
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', '${handler}')`, detail: `AJAX handler '${handler}()' does not verify a nonce (wp_verify_nonce / check_ajax_referer) — CSRF.` });
     }
   }
   const adminRe = /add_action\s*\(\s*['"](admin_post(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
@@ -56382,26 +56400,10 @@ function detectMissingAuthz(code, file) {
     const hasNonce = /wp_verify_nonce|check_admin_referer|verify_nonce/.test(body);
     const line = lineNoOf(code, m.index);
     if (nopriv && !hasCap) {
-      out.push({
-        file,
-        line,
-        type: "missing_authz",
-        category: "Missing capability check (unauthenticated admin-post handler)",
-        severity: "high",
-        evidence: `add_action('${hook}', '${handler}')`,
-        detail: `Unauthenticated admin-post handler '${handler}()' has no authorization check — auth bypass / privilege escalation.`
-      });
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated admin-post handler)", severity: "high", evidence: `add_action('${hook}', '${handler}')`, detail: `Unauthenticated admin-post handler '${handler}()' has no authorization check — auth bypass / privilege escalation.` });
     }
     if (!hasNonce) {
-      out.push({
-        file,
-        line,
-        type: "missing_nonce",
-        category: "Missing nonce verification",
-        severity: "medium",
-        evidence: `add_action('${hook}', '${handler}')`,
-        detail: `admin-post handler '${handler}()' does not verify a nonce — CSRF.`
-      });
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', '${handler}')`, detail: `admin-post handler '${handler}()' does not verify a nonce — CSRF.` });
     }
   }
   const restRe = /register_rest_route\s*\(\s*['"]([^'"]+)['"]\s*,\s*['"]([^'"]+)['"]/g;
@@ -56410,16 +56412,47 @@ function detectMissingAuthz(code, file) {
     const window2 = code.slice(m.index, m.index + 800);
     if (/permission_callback/.test(window2))
       continue;
-    out.push({
-      file,
-      line,
-      type: "missing_authz",
-      category: "REST route missing permission_callback",
-      severity: "high",
-      evidence: `register_rest_route('${m[1]}', '${m[2]}')`,
-      detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass / unauthenticated data access or mutation).`
-    });
+    out.push({ file, line, type: "missing_authz", category: "REST route missing permission_callback", severity: "high", evidence: `register_rest_route('${m[1]}', '${m[2]}')`, detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass).` });
+  }
+}
+var ROUTE_DETECTORS = [
+  { framework: "laravel", entry: /Route::(?:get|post|put|patch|delete|any|match|resource)\s*\(\s*['"][^'"]+['"]/g, auth: /->middleware\s*\(\s*['"]auth|middleware\s*\(\s*\[[^\]]*['"]auth|->can\s*\(|\$this->authorize|Gate::|authorize\s*\(|@can\b/, window: 2 },
+  { framework: "django", entry: /@api_view\s*\(|def\s+\w+\s*\(\s*request\s*[,)]/g, auth: /login_required|permission_required|user_passes_test|LoginRequiredMixin|PermissionRequiredMixin|permission_classes|IsAuthenticated|has_permission/, window: 3 },
+  { framework: "flask", entry: /@(?:app|bp|blueprint)\.route\s*\(/g, auth: /login_required|current_user\.is_authenticated|permission_required/, window: 3 },
+  { framework: "express", entry: /(?:app|router)\.(?:get|post|put|delete|patch|use)\s*\(\s*['"][^'"]+['"]/g, auth: /requireAuth|authenticate|passport\.authenticate|req\.user|isAuthenticated|ensureAuthenticated|requireLogin|\.authorize|authMiddleware/, window: 2 },
+  { framework: "spring", entry: /@(?:Get|Post|Put|Delete|Patch|Request)Mapping\s*\(/g, auth: /@PreAuthorize|@Secured|@RolesAllowed|hasRole|hasAuthority|isAuthenticated|SecurityContextHolder/, window: 2 },
+  { framework: "symfony", entry: /#\[(?:Route|Get|Post|Put|Delete|Patch)\b|@Route\s*\(/g, auth: /is_granted|denyAccessUnlessGranted|->isGranted\s*\(|IsGranted|Voter/, window: 2 },
+  { framework: "aspnet", entry: /\[Http(?:Get|Post|Put|Delete|Patch)\b/g, auth: /\[Authorize|User\.Identity|IsInRole|AuthorizeAsync|\[AllowAnonymous|IAuthorizationService/, window: 2 },
+  { framework: "rails", entry: /class\s+\w+\s*<\s*ApplicationController/g, auth: /before_action\s+:authenticate|before_action\s+:authorize|authenticate_user!|authorize\s+|current_user|authenticate/, window: 6 }
+];
+function detectRouteAuthz(code, file, out) {
+  const ls = code.split(`
+`);
+  for (const d of ROUTE_DETECTORS) {
+    d.entry.lastIndex = 0;
+    let m;
+    while ((m = d.entry.exec(code)) !== null) {
+      const ln = lineNoOf(code, m.index);
+      const window2 = ls.slice(Math.max(0, ln - d.window), Math.min(ls.length, ln + d.window + 1)).join(`
+`);
+      if (d.auth.test(window2))
+        continue;
+      out.push({
+        file,
+        line: ln,
+        type: "missing_authz",
+        category: `${d.framework}: endpoint without authorization`,
+        severity: "high",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `${d.framework} endpoint has no authorization enforcement in the surrounding ${d.window}-line window — auth bypass / privilege escalation.`
+      });
+    }
   }
+}
+function detectMissingAuthz(code, file) {
+  const out = [];
+  detectWpAuthz(code, file, out);
+  detectRouteAuthz(code, file, out);
   const seen = new Set;
   return out.filter((f) => {
     const key = `${f.type}:${f.line}`;
@@ -57054,8 +57087,85 @@ function openCount() {
   return loadObligations().filter((o) => o.status === "open").length;
 }
 
+// src/variant-scan.ts
+init_scanner();
+import { readFileSync as readFileSync19 } from "node:fs";
+function deriveSignature(detector, type) {
+  return `${detector}:${type}`;
+}
+function variantScan(root, opts = {}) {
+  const files = iterSourceFiles(root, opts.maxFiles ?? 5000);
+  const hits = [];
+  for (const file of files) {
+    let code;
+    try {
+      code = readFileSync19(file, "utf8");
+    } catch {
+      continue;
+    }
+    try {
+      const taint = analyzeTaint(file);
+      for (const f of taint.findings) {
+        const type = f.category ?? f.sink ?? "taint";
+        hits.push({
+          file,
+          detector: "taint",
+          type,
+          signature: deriveSignature("taint", type),
+          line: f.sink_line ?? 0,
+          severity: "high",
+          evidence: f.sink ?? ""
+        });
+      }
+    } catch {}
+    for (const f of detectComplexBugs(code, file)) {
+      hits.push({
+        file,
+        detector: "complex_bugs",
+        type: f.type,
+        signature: deriveSignature("complex_bugs", f.type),
+        line: f.line,
+        severity: f.severity,
+        evidence: f.evidence
+      });
+    }
+    for (const f of detectRouteConfusion(code, file)) {
+      hits.push({
+        file,
+        detector: "route_confusion",
+        type: f.type,
+        signature: deriveSignature("route_confusion", f.type),
+        line: f.line,
+        severity: f.severity,
+        evidence: f.evidence
+      });
+    }
+  }
+  const bySignature = {};
+  for (const h of hits)
+    bySignature[h.signature] = (bySignature[h.signature] ?? 0) + 1;
+  const filtered = opts.signature ? hits.filter((h) => h.signature === opts.signature) : hits;
+  const filesWithFindings = new Set(filtered.map((h) => h.file));
+  return {
+    root,
+    files_scanned: files.length,
+    files_with_findings: filesWithFindings.size,
+    total_findings: filtered.length,
+    signature: opts.signature ?? null,
+    by_signature: bySignature,
+    hits: filtered.map((h) => ({
+      file: h.file,
+      detector: h.detector,
+      type: h.type,
+      signature: h.signature,
+      line: h.line,
+      severity: h.severity
+    }))
+  };
+}
+
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync11, readFileSync as readFileSync19, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
@@ -57097,7 +57207,7 @@ function detectFixture(dir) {
   for (const f of sourceFiles(dir)) {
     let code;
     try {
-      code = readFileSync19(f, "utf8");
+      code = readFileSync20(f, "utf8");
     } catch {
       continue;
     }
@@ -57999,14 +58109,28 @@ ${statusLine}` : statusLine },
     return { content: [{ type: "text", text: JSON.stringify(analyzeSecurityState({ sanitizers: arr, sinkType: sink_type })) }] };
   });
   server.registerTool("framework_knowledge", {
-    title: "Framework security knowledge graph",
-    description: "FRAMEWORK-KNOWLEDGE: return a framework's security primitives as data — authorization primitives (current_user_can, is_user_logged_in), nonce/CSRF primitives (wp_verify_nonce, check_ajax_referer), entry-point hooks (wp_ajax_*, admin_post_*, register_rest_route), and sanitizers. Powers the missing-authz/nonce detector. Extensible to other frameworks.",
+    title: "Framework security knowledge graph (multi-framework)",
+    description: "FRAMEWORK-KNOWLEDGE: return a framework's security primitives as data — authorization primitives, nonce/CSRF primitives, entry-point hooks, and sanitizers. Supports wordpress, laravel, django, flask, express, spring, symfony, aspnet, rails. Powers the multi-framework missing-authz/nonce detector.",
     inputSchema: {
-      framework: string2().optional().describe("Framework id (default 'wordpress')")
+      framework: string2().optional().describe("Framework id (wordpress, laravel, django, flask, express, spring, symfony, aspnet, rails)")
     }
   }, async ({ framework }) => {
     const k = frameworkKnowledge(framework ?? "wordpress");
-    return { content: [{ type: "text", text: JSON.stringify(k ?? { error: "framework not in the knowledge graph", framework }) }] };
+    if (!k) {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "framework not in the knowledge graph", framework, available: listFrameworks2() }) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(k) }] };
+  });
+  server.registerTool("variant_scan", {
+    title: "Mass variant-mining scan of an install base",
+    description: "VARIANT-MINING: mass-scan a source tree (plugin/theme/repo install base) with ALL detectors (taint, complex-bugs incl. wrong-context sanitization + missing authz/nonce, route-confusion) and report hits grouped by DERIVED signature (<detector>:<type>). Pass `signature` to mine for ONE bug family (e.g. complex_bugs:missing_authz) — the 'confirm once, weaponize everywhere' pattern that turns one CVE into hundreds of variants across an install base.",
+    inputSchema: {
+      root: string2().describe("Root directory to scan"),
+      max_files: number2().optional().describe("Max files to scan (default 5000)"),
+      signature: string2().optional().describe("Filter to one bug family (e.g. complex_bugs:missing_authz)")
+    }
+  }, async ({ root, max_files, signature }) => {
+    return { content: [{ type: "text", text: JSON.stringify(variantScan(root, { maxFiles: max_files, signature })) }] };
   });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
@@ -58546,7 +58670,7 @@ ${statusLine}` : statusLine },
     description: "Route confusion (separate class from source→sink taint): detect attacker-controlled dispatch (call_user_func/forward/dispatch), dynamic method calls ($obj->$m()), dynamic include (LFI), batch/proxy forwarding without per-route auth re-check, and route matching without path normalization.",
     inputSchema: { path: string2().describe("Source file path (PHP)") }
   }, async ({ path }) => {
-    const code = readFileSync21(path, "utf8");
+    const code = readFileSync22(path, "utf8");
     const findings = detectRouteConfusion(code, path);
     return {
       content: [{
@@ -58560,7 +58684,7 @@ ${statusLine}` : statusLine },
     description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), and missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
-    const code = readFileSync21(path, "utf8");
+    const code = readFileSync22(path, "utf8");
     const findings = detectComplexBugs(code, path);
     return {
       content: [{
@@ -58627,7 +58751,7 @@ ${statusLine}` : statusLine },
     let lang = language;
     if (path && !code) {
       try {
-        src = readFileSync21(path, "utf8");
+        src = readFileSync22(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
       }
@@ -58868,7 +58992,7 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync25, existsSync as existsSync14 } from "node:fs";
+import { readFileSync as readFileSync26, existsSync as existsSync14 } from "node:fs";
 import { join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 var ROOT11 = join23(fileURLToPath13(new URL(".", import.meta.url)), "..");
@@ -58876,7 +59000,7 @@ function readVersion() {
   try {
     const p = join23(ROOT11, "package.json");
     if (existsSync14(p))
-      return JSON.parse(readFileSync25(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync26(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.34",
+  "version": "2.4.36",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {