blitzstrike 2.4.35 → 2.4.37

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.37] — 2026-09-14
+
+### Fixed — benchmark top-level recall/f1 (self-audit)
+
+- `run_benchmark` now returns top-level `recall` and `f1` (previously only
+  `detection_rate` held the recall value, and no top-level f1). Matches the
+  per-detector shape for consistency. No functional change.
+
+## [2.4.36] — 2026-09-14
+
+### Changed — Framework Knowledge Graph is now MULTI-framework (not WordPress-only)
+
+- `framework-security.ts` now covers 9 frameworks: WordPress, Laravel, Django,
+  Flask, Express, Spring, Symfony, ASP.NET Core, Ruby on Rails — each with its
+  auth / nonce / entry-point / sanitizer primitives as data.
+- `detectMissingAuthz` now detects missing authorization across ALL frameworks
+  (route middleware, decorators, annotations), not just WP AJAX/REST hooks.
+- `framework_knowledge` tool returns the framework list on an unknown id.
+
 ## [2.4.35] — 2026-09-14
 
 ### Added — Variant Mining (confirm once, weaponize everywhere)

package/dist/index.js

@@ -56260,52 +56260,94 @@ function detectWrongSanitizer(code, file) {
 }
 
 // src/framework-security.ts
-var WP_PRIMITIVES = {
-  framework: "wordpress",
-  auth_primitives: [
-    "current_user_can",
-    "current_user_can_edit_post",
-    "current_user_can_for_blog",
-    "current_user_can_edit_others_posts",
-    "is_user_logged_in",
-    "authorize"
-  ],
-  nonce_primitives: [
-    "wp_verify_nonce",
-    "check_ajax_referer",
-    "check_admin_referer",
-    "verify_nonce"
-  ],
-  entry_point_hooks: [
-    "wp_ajax_",
-    "wp_ajax_nopriv_",
-    "admin_post_",
-    "admin_post_nopriv_",
-    "register_rest_route",
-    "add_shortcode",
-    "init",
-    "rest_api_init"
-  ],
-  sanitizers: [
-    "sanitize_text_field",
-    "esc_sql",
-    "esc_html",
-    "esc_attr",
-    "esc_url",
-    "wp_kses",
-    "wp_kses_post",
-    "absint",
-    "sanitize_email",
-    "sanitize_file_name"
-  ]
-};
 var FRAMEWORKS = {
-  wordpress: WP_PRIMITIVES,
-  wp: WP_PRIMITIVES
+  wordpress: {
+    framework: "wordpress",
+    auth_primitives: ["current_user_can", "current_user_can_edit_post", "is_user_logged_in", "authorize"],
+    nonce_primitives: ["wp_verify_nonce", "check_ajax_referer", "check_admin_referer", "verify_nonce"],
+    entry_point_hooks: ["wp_ajax_", "wp_ajax_nopriv_", "admin_post_", "admin_post_nopriv_", "register_rest_route", "add_shortcode", "init", "rest_api_init"],
+    sanitizers: ["sanitize_text_field", "esc_sql", "esc_html", "esc_attr", "esc_url", "wp_kses", "wp_kses_post", "absint", "sanitize_email", "sanitize_file_name"]
+  },
+  wp: {
+    framework: "wordpress",
+    auth_primitives: ["current_user_can", "is_user_logged_in", "authorize"],
+    nonce_primitives: ["wp_verify_nonce", "check_ajax_referer", "check_admin_referer"],
+    entry_point_hooks: ["wp_ajax_", "wp_ajax_nopriv_", "register_rest_route"],
+    sanitizers: ["sanitize_text_field", "esc_sql", "esc_html", "absint"]
+  },
+  laravel: {
+    framework: "laravel",
+    auth_primitives: ["auth", "authorize", "Gate::", "can:", "->middleware('auth'", "->can(", "$this->authorize", "@can", "@cannot", "policy"],
+    nonce_primitives: ["@csrf", "csrf_field", "VerifyCsrfToken"],
+    entry_point_hooks: ["Route::get", "Route::post", "Route::put", "Route::delete", "Route::resource", "Route::match"],
+    sanitizers: ["e(", "htmlspecialchars", "clean(", "strip_tags"]
+  },
+  django: {
+    framework: "django",
+    auth_primitives: ["login_required", "permission_required", "user_passes_test", "LoginRequiredMixin", "PermissionRequiredMixin", "permission_classes", "IsAuthenticated", "has_permission"],
+    nonce_primitives: ["csrf_protect", "CsrfViewMiddleware", "@csrf"],
+    entry_point_hooks: ["def ", "@api_view", "path(", "url(", "re_path("],
+    sanitizers: ["escape(", "mark_safe", "html.escape"]
+  },
+  flask: {
+    framework: "flask",
+    auth_primitives: ["login_required", "@login_required", "current_user.is_authenticated", "permission_required"],
+    nonce_primitives: ["CSRFProtect", "csrf_token"],
+    entry_point_hooks: ["@app.route", "@blueprint.route", "@bp.route"],
+    sanitizers: ["escape(", "Markup", "html.escape"]
+  },
+  express: {
+    framework: "express",
+    auth_primitives: ["requireAuth", "authenticate", "passport.authenticate", "req.user", "isAuthenticated", "ensureAuthenticated", "requireLogin", "authorize", "authMiddleware"],
+    nonce_primitives: ["csurf", "csrfProtection", "helmet"],
+    entry_point_hooks: ["app.get", "app.post", "router.get", "router.post"],
+    sanitizers: ["escapeHtml", "encodeURIComponent", "sanitize", "xss"]
+  },
+  spring: {
+    framework: "spring",
+    auth_primitives: ["@PreAuthorize", "@Secured", "@RolesAllowed", "hasRole", "hasAuthority", "isAuthenticated", "SecurityContextHolder"],
+    nonce_primitives: ["csrf", "CsrfToken"],
+    entry_point_hooks: ["@GetMapping", "@PostMapping", "@RequestMapping", "@Controller"],
+    sanitizers: ["HtmlUtils.htmlEscape", "escapeHtml", "StringEscapeUtils"]
+  },
+  symfony: {
+    framework: "symfony",
+    auth_primitives: ["is_granted", "denyAccessUnlessGranted", "->isGranted(", "IsGranted", "Voter"],
+    nonce_primitives: ["isCsrfTokenValid", "csrf_token"],
+    entry_point_hooks: ["#[Route", "@Route", "#[Get", "#[Post"],
+    sanitizers: ["e(", "htmlspecialchars", "escape("]
+  },
+  aspnet: {
+    framework: "aspnet",
+    auth_primitives: ["[Authorize", "[AllowAnonymous", "User.Identity", "IsInRole", "AuthorizeAsync", "IAuthorizationService"],
+    nonce_primitives: ["ValidateAntiForgeryToken", "Antiforgery"],
+    entry_point_hooks: ["[HttpGet", "[HttpPost", "[Route("],
+    sanitizers: ["HtmlEncoder", "Html.Raw", "UrlEncoder"]
+  },
+  rails: {
+    framework: "rails",
+    auth_primitives: ["authenticate_user!", "authorize", "before_action :authenticate", "before_action :authorize", "current_user"],
+    nonce_primitives: ["protect_from_forgery", "form_authenticity_token"],
+    entry_point_hooks: ["def ", "before_action"],
+    sanitizers: ["h(", "html_escape", "sanitize"]
+  }
 };
 function frameworkKnowledge(framework = "wordpress") {
   return FRAMEWORKS[framework.toLowerCase()] ?? null;
 }
+function listFrameworks2() {
+  const s = new Set;
+  for (const k of Object.keys(FRAMEWORKS))
+    s.add(FRAMEWORKS[k].framework);
+  return [...s];
+}
+function lineNoOf(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
 function functionBody(code, name) {
   const idx = code.search(new RegExp(`function\\s+${name}\\s*\\(`));
   if (idx === -1)
@@ -56325,16 +56367,8 @@ function functionBody(code, name) {
   }
   return code.slice(open);
 }
-function lineNoOf(code, pos) {
-  let n = 1;
-  for (let i = 0;i < pos; i++)
-    if (code.charCodeAt(i) === 10)
-      n++;
-  return n;
-}
 var INDIRECT_AUTH = /\b[a-zA-Z0-9_]*(auth|permission|cap|nonce|can_|check|verify|allow)[a-zA-Z0-9_]*\s*\(/;
-function detectMissingAuthz(code, file) {
-  const out = [];
+function detectWpAuthz(code, file, out) {
   const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
   let m;
   while ((m = ajaxRe.exec(code)) !== null) {
@@ -56348,26 +56382,10 @@ function detectMissingAuthz(code, file) {
     const hasNonce = /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/.test(body);
     const line = lineNoOf(code, m.index);
     if (nopriv && !hasCap) {
-      out.push({
-        file,
-        line,
-        type: "missing_authz",
-        category: "Missing capability check (unauthenticated AJAX handler)",
-        severity: "high",
-        evidence: `add_action('${hook}', '${handler}')`,
-        detail: `Unauthenticated AJAX handler '${handler}()' performs no current_user_can()/authorization check — any unauthenticated visitor can trigger it (auth bypass / privilege escalation).`
-      });
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated AJAX handler)", severity: "high", evidence: `add_action('${hook}', '${handler}')`, detail: `Unauthenticated AJAX handler '${handler}()' performs no current_user_can()/authorization check — any unauthenticated visitor can trigger it (auth bypass / privilege escalation).` });
     }
     if (!hasNonce) {
-      out.push({
-        file,
-        line,
-        type: "missing_nonce",
-        category: "Missing nonce verification",
-        severity: "medium",
-        evidence: `add_action('${hook}', '${handler}')`,
-        detail: `AJAX handler '${handler}()' does not verify a nonce (wp_verify_nonce / check_ajax_referer) — CSRF: an attacker can force an authenticated admin to trigger it.`
-      });
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', '${handler}')`, detail: `AJAX handler '${handler}()' does not verify a nonce (wp_verify_nonce / check_ajax_referer) — CSRF.` });
     }
   }
   const adminRe = /add_action\s*\(\s*['"](admin_post(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
@@ -56382,26 +56400,10 @@ function detectMissingAuthz(code, file) {
     const hasNonce = /wp_verify_nonce|check_admin_referer|verify_nonce/.test(body);
     const line = lineNoOf(code, m.index);
     if (nopriv && !hasCap) {
-      out.push({
-        file,
-        line,
-        type: "missing_authz",
-        category: "Missing capability check (unauthenticated admin-post handler)",
-        severity: "high",
-        evidence: `add_action('${hook}', '${handler}')`,
-        detail: `Unauthenticated admin-post handler '${handler}()' has no authorization check — auth bypass / privilege escalation.`
-      });
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated admin-post handler)", severity: "high", evidence: `add_action('${hook}', '${handler}')`, detail: `Unauthenticated admin-post handler '${handler}()' has no authorization check — auth bypass / privilege escalation.` });
     }
     if (!hasNonce) {
-      out.push({
-        file,
-        line,
-        type: "missing_nonce",
-        category: "Missing nonce verification",
-        severity: "medium",
-        evidence: `add_action('${hook}', '${handler}')`,
-        detail: `admin-post handler '${handler}()' does not verify a nonce — CSRF.`
-      });
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', '${handler}')`, detail: `admin-post handler '${handler}()' does not verify a nonce — CSRF.` });
     }
   }
   const restRe = /register_rest_route\s*\(\s*['"]([^'"]+)['"]\s*,\s*['"]([^'"]+)['"]/g;
@@ -56410,16 +56412,47 @@ function detectMissingAuthz(code, file) {
     const window2 = code.slice(m.index, m.index + 800);
     if (/permission_callback/.test(window2))
       continue;
-    out.push({
-      file,
-      line,
-      type: "missing_authz",
-      category: "REST route missing permission_callback",
-      severity: "high",
-      evidence: `register_rest_route('${m[1]}', '${m[2]}')`,
-      detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass / unauthenticated data access or mutation).`
-    });
+    out.push({ file, line, type: "missing_authz", category: "REST route missing permission_callback", severity: "high", evidence: `register_rest_route('${m[1]}', '${m[2]}')`, detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass).` });
+  }
+}
+var ROUTE_DETECTORS = [
+  { framework: "laravel", entry: /Route::(?:get|post|put|patch|delete|any|match|resource)\s*\(\s*['"][^'"]+['"]/g, auth: /->middleware\s*\(\s*['"]auth|middleware\s*\(\s*\[[^\]]*['"]auth|->can\s*\(|\$this->authorize|Gate::|authorize\s*\(|@can\b/, window: 2 },
+  { framework: "django", entry: /@api_view\s*\(|def\s+\w+\s*\(\s*request\s*[,)]/g, auth: /login_required|permission_required|user_passes_test|LoginRequiredMixin|PermissionRequiredMixin|permission_classes|IsAuthenticated|has_permission/, window: 3 },
+  { framework: "flask", entry: /@(?:app|bp|blueprint)\.route\s*\(/g, auth: /login_required|current_user\.is_authenticated|permission_required/, window: 3 },
+  { framework: "express", entry: /(?:app|router)\.(?:get|post|put|delete|patch|use)\s*\(\s*['"][^'"]+['"]/g, auth: /requireAuth|authenticate|passport\.authenticate|req\.user|isAuthenticated|ensureAuthenticated|requireLogin|\.authorize|authMiddleware/, window: 2 },
+  { framework: "spring", entry: /@(?:Get|Post|Put|Delete|Patch|Request)Mapping\s*\(/g, auth: /@PreAuthorize|@Secured|@RolesAllowed|hasRole|hasAuthority|isAuthenticated|SecurityContextHolder/, window: 2 },
+  { framework: "symfony", entry: /#\[(?:Route|Get|Post|Put|Delete|Patch)\b|@Route\s*\(/g, auth: /is_granted|denyAccessUnlessGranted|->isGranted\s*\(|IsGranted|Voter/, window: 2 },
+  { framework: "aspnet", entry: /\[Http(?:Get|Post|Put|Delete|Patch)\b/g, auth: /\[Authorize|User\.Identity|IsInRole|AuthorizeAsync|\[AllowAnonymous|IAuthorizationService/, window: 2 },
+  { framework: "rails", entry: /class\s+\w+\s*<\s*ApplicationController/g, auth: /before_action\s+:authenticate|before_action\s+:authorize|authenticate_user!|authorize\s+|current_user|authenticate/, window: 6 }
+];
+function detectRouteAuthz(code, file, out) {
+  const ls = code.split(`
+`);
+  for (const d of ROUTE_DETECTORS) {
+    d.entry.lastIndex = 0;
+    let m;
+    while ((m = d.entry.exec(code)) !== null) {
+      const ln = lineNoOf(code, m.index);
+      const window2 = ls.slice(Math.max(0, ln - d.window), Math.min(ls.length, ln + d.window + 1)).join(`
+`);
+      if (d.auth.test(window2))
+        continue;
+      out.push({
+        file,
+        line: ln,
+        type: "missing_authz",
+        category: `${d.framework}: endpoint without authorization`,
+        severity: "high",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `${d.framework} endpoint has no authorization enforcement in the surrounding ${d.window}-line window — auth bypass / privilege escalation.`
+      });
+    }
   }
+}
+function detectMissingAuthz(code, file) {
+  const out = [];
+  detectWpAuthz(code, file, out);
+  detectRouteAuthz(code, file, out);
   const seen = new Set;
   return out.filter((f) => {
     const key = `${f.type}:${f.line}`;
@@ -56903,6 +56936,8 @@ function runBenchmark() {
   const detectionRate = tp + fn > 0 ? tp / (tp + fn) : 0;
   const falsePositiveRate = fp + tn > 0 ? fp / (fp + tn) : 0;
   const precision = tp + fp > 0 ? tp / (tp + fp) : 0;
+  const recall = detectionRate;
+  const f1 = precision + recall > 0 ? 2 * precision * recall / (precision + recall) : 0;
   const byDetector = {};
   for (const r of results) {
     const d = r.entry.detector ?? "taint";
@@ -56927,6 +56962,8 @@ function runBenchmark() {
     detection_rate: Number(detectionRate.toFixed(3)),
     false_positive_rate: Number(falsePositiveRate.toFixed(3)),
     precision: Number(precision.toFixed(3)),
+    recall: Number(recall.toFixed(3)),
+    f1: Number(f1.toFixed(3)),
     by_detector: detectorMetrics,
     captured_false_positives: {
       total: captured.length,
@@ -58076,14 +58113,17 @@ ${statusLine}` : statusLine },
     return { content: [{ type: "text", text: JSON.stringify(analyzeSecurityState({ sanitizers: arr, sinkType: sink_type })) }] };
   });
   server.registerTool("framework_knowledge", {
-    title: "Framework security knowledge graph",
-    description: "FRAMEWORK-KNOWLEDGE: return a framework's security primitives as data — authorization primitives (current_user_can, is_user_logged_in), nonce/CSRF primitives (wp_verify_nonce, check_ajax_referer), entry-point hooks (wp_ajax_*, admin_post_*, register_rest_route), and sanitizers. Powers the missing-authz/nonce detector. Extensible to other frameworks.",
+    title: "Framework security knowledge graph (multi-framework)",
+    description: "FRAMEWORK-KNOWLEDGE: return a framework's security primitives as data — authorization primitives, nonce/CSRF primitives, entry-point hooks, and sanitizers. Supports wordpress, laravel, django, flask, express, spring, symfony, aspnet, rails. Powers the multi-framework missing-authz/nonce detector.",
     inputSchema: {
-      framework: string2().optional().describe("Framework id (default 'wordpress')")
+      framework: string2().optional().describe("Framework id (wordpress, laravel, django, flask, express, spring, symfony, aspnet, rails)")
     }
   }, async ({ framework }) => {
     const k = frameworkKnowledge(framework ?? "wordpress");
-    return { content: [{ type: "text", text: JSON.stringify(k ?? { error: "framework not in the knowledge graph", framework }) }] };
+    if (!k) {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "framework not in the knowledge graph", framework, available: listFrameworks2() }) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(k) }] };
   });
   server.registerTool("variant_scan", {
     title: "Mass variant-mining scan of an install base",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.35",
+  "version": "2.4.37",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {