blitzstrike 2.4.37 → 2.4.39

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.39] — 2026-09-14
+
+### Added — Patch Reversal (1-day weaponization engine)
+
+- `analyzePatch` (in differential.ts): read a security patch (old vs new code)
+  and REVERSE it — detect what the patch ADDED (sanitizer, auth/nonce gate,
+  parameterized query, input validation) or REMOVED (a dangerous sink fed by
+  attacker input), and reconstruct the vulnerability in the OLD version.
+- New `patch_analyze` tool: each reversal carries a DERIVED `mine_signature` to
+  sweep unpatched installs via `variant_scan(root, { signature })`.
+- A cosmetic-only change (no security delta) correctly yields no reversal.
+
+## [2.4.38] — 2026-09-14
+
+### Added — Action-Name Heuristic Engine (what to look for WHERE)
+
+- New `src/action-heuristics.ts`: maps WordPress AJAX action-name patterns to
+  their likely vulnerability class (upload/import→AFU/RCE, delete/write→
+  file-write, load/download→LFI, login/reset→auth-bypass, exec/run→command
+  injection, settings/update→unauth options change, …) — as DATA, with real
+  examples (ai1wm_import, revslider_upload, duplicator_download, …).
+- New `action_surface` tool: extract every `wp_ajax_*` action, cross-reference
+  the hook (nopriv?) + authz gap (nonce/capability), and return a DERIVED
+  priority so the scanner targets the most dangerous action first.
+
 ## [2.4.37] — 2026-09-14
 
 ### Fixed — benchmark top-level recall/f1 (self-audit)

package/dist/index.js

@@ -55613,6 +55613,110 @@ function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
   const security_sensitive = files.reduce((n, f) => n + f.result.changes.filter((c) => c.severity === "high").length, 0);
   return { repo, base, head, files, total_changes, security_sensitive };
 }
+var PATCH_RANK = { high: 0, medium: 1 };
+function analyzePatch(oldCode, newCode, language = "php") {
+  const { added, removed } = diffLines(oldCode, newCode);
+  const findings = [];
+  for (const l of added) {
+    const sans = findSanitizers(l.text);
+    if (sans.length > 0) {
+      findings.push({
+        kind: "sanitizer_added",
+        old_vuln: "raw attacker input reached a sink without escaping",
+        new_fix: l.text.trim(),
+        severity: "high",
+        line: l.line,
+        detail: `sanitizer ADDED: ${sans.map((s) => s.label).join(", ")} — the OLD version passed raw input to a sink (sanitization gap).`,
+        signature: "patch:sanitizer_added",
+        mine_signature: "complex_bugs:wrong_sanitizer"
+      });
+    }
+    const gates = AUTH_GATES.filter((g) => l.text.includes(g));
+    if (gates.length > 0) {
+      findings.push({
+        kind: "authorization_added",
+        old_vuln: "missing authorization / nonce check",
+        new_fix: l.text.trim(),
+        severity: "high",
+        line: l.line,
+        detail: `authorization gate ADDED: ${gates.join(", ")} — the OLD version performed no auth/nonce check (auth bypass / CSRF).`,
+        signature: "patch:authorization_added",
+        mine_signature: "complex_bugs:missing_authz"
+      });
+    }
+    if (/->prepare\s*\(|\bprepare\s*\(\s*["']/.test(l.text)) {
+      findings.push({
+        kind: "prepared_statement_added",
+        old_vuln: "raw SQL string interpolation",
+        new_fix: l.text.trim(),
+        severity: "high",
+        line: l.line,
+        detail: "parameterized query ADDED — the OLD version concatenated user input into SQL (SQLi).",
+        signature: "patch:prepared_statement_added",
+        mine_signature: "complex_bugs:wrong_sanitizer"
+      });
+    }
+    if (/preg_match\s*\(\s*["']\/\^|in_array\s*\(\s*\$|ctype_[a-z]+|is_numeric\s*\(|filter_var\s*\(/.test(l.text)) {
+      findings.push({
+        kind: "validation_added",
+        old_vuln: "unvalidated / arbitrary input accepted",
+        new_fix: l.text.trim(),
+        severity: "medium",
+        line: l.line,
+        detail: "input validation ADDED — the OLD version accepted arbitrary input (type/format gap).",
+        signature: "patch:validation_added",
+        mine_signature: "complex_bugs:wrong_sanitizer"
+      });
+    }
+  }
+  for (const l of removed) {
+    const sink = classifySink2(l.text);
+    const source = classifySource(l.text);
+    if (sink && source && source.attacker_controlled) {
+      findings.push({
+        kind: "sink_removed",
+        old_vuln: `dangerous sink fed by attacker input: ${sink.category}`,
+        new_fix: "(removed)",
+        cwe: sink.cwe,
+        severity: "high",
+        line: l.line,
+        detail: `sink REMOVED: ${l.text.trim()} (${sink.category}) — the OLD version executed this dangerous operation on attacker input.`,
+        signature: `patch:sink_removed:${sink.category}`,
+        mine_signature: `taint:${sink.category}`
+      });
+    }
+  }
+  findings.sort((a, b) => PATCH_RANK[a.severity] - PATCH_RANK[b.severity] || a.line - b.line);
+  const count = (k) => findings.filter((f) => f.kind === k).length;
+  return {
+    language,
+    reversal_findings: findings.map((f) => ({
+      kind: f.kind,
+      old_vuln: f.old_vuln,
+      new_fix: f.new_fix,
+      cwe: f.cwe,
+      line: f.line,
+      severity: f.severity,
+      detail: f.detail,
+      signature: f.signature,
+      mine_signature: f.mine_signature
+    })),
+    summary: {
+      sanitizer_added: count("sanitizer_added"),
+      authorization_added: count("authorization_added"),
+      prepared_statement_added: count("prepared_statement_added"),
+      validation_added: count("validation_added"),
+      sink_removed: count("sink_removed")
+    },
+    interpretation: "Each reversal is the vulnerability REVERSED from the patch: the OLD version had this bug, the NEW version fixed it. Sweep unpatched installs with variant_scan(root, { signature: mine_signature })."
+  };
+}
+function analyzePatchFiles(oldPath, newPath, language) {
+  const oldCode = readFileSync15(oldPath, "utf8");
+  const newCode = readFileSync15(newPath, "utf8");
+  const lang = language ?? languageOf(newPath);
+  return analyzePatch(oldCode, newCode, lang);
+}
 
 // src/frameworks.ts
 import { readFileSync as readFileSync16, existsSync as existsSync8 } from "node:fs";
@@ -57168,6 +57272,101 @@ function variantScan(root, opts = {}) {
   };
 }
 
+// src/action-heuristics.ts
+var ACTION_HEURISTICS = [
+  { pattern: /upload|import|install|activate|plugin|theme/, vuln_class: "Arbitrary File Upload / Plugin Install → RCE", detector: "file_upload + missing_authz", weight: 0.9, examples: ["ai1wm_import", "ocdi_upload_manual_import_files", "alone_import_pack_install_plugin", "revslider_upload"] },
+  { pattern: /write|save|delete|remove|move|rename/, vuln_class: "Arbitrary File Write / Delete / Move", detector: "file_operations", weight: 0.8, examples: ["ai1wm_backup_delete"] },
+  { pattern: /load|include|template|file|download|read/, vuln_class: "LFI / Path Traversal / RFI", detector: "path_traversal + file_inclusion", weight: 0.8, examples: ["duplicator_download", "get_file", "preview"] },
+  { pattern: /exec|run|cmd|shell|eval|code/, vuln_class: "OS Command / Code Injection / eval", detector: "command_execution + code_execution", weight: 0.85, examples: [] },
+  { pattern: /import|unserialize|restore|data/, vuln_class: "Insecure Deserialization / Object Injection", detector: "deserialization", weight: 0.8, examples: [] },
+  { pattern: /query|search|filter|export|list/, vuln_class: "SQLi → RCE / Create Admin", detector: "sql_execution", weight: 0.7, examples: [] },
+  { pattern: /render|shortcode|block|preview/, vuln_class: "SSTI / Shortcode / Block Injection", detector: "ssti", weight: 0.6, examples: [] },
+  { pattern: /settings|option|update/, vuln_class: "Unauth Options Update / Settings Change / Missing Cap+Nonce", detector: "missing_authz + missing_nonce", weight: 0.85, examples: ["woocommerce_*", "elementor_*"] },
+  { pattern: /login|auth|token|reset|verify/, vuln_class: "Auth Bypass / Auto Login / Account Takeover", detector: "missing_authz + type_juggling", weight: 0.9, examples: ["auto-login", "magic link", "reset password"] },
+  { pattern: /role|capability|promote|change_role/, vuln_class: "Privilege Escalation", detector: "missing_authz", weight: 0.9, examples: [] },
+  { pattern: /register|signup|create_user/, vuln_class: "Register → RCE / AFU / PrivEsc", detector: "file_upload + missing_authz", weight: 0.8, examples: [] }
+];
+function mapActionToVuln(action) {
+  const a = action.toLowerCase();
+  for (const h of ACTION_HEURISTICS) {
+    if (h.pattern.test(a)) {
+      return { vuln_class: h.vuln_class, detector: h.detector, weight: h.weight, examples: h.examples };
+    }
+  }
+  return null;
+}
+function actionSurface(code) {
+  const entries = [];
+  const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
+  let m;
+  while ((m = ajaxRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = m[2];
+    const nopriv = hook.startsWith("wp_ajax_nopriv_");
+    const action = hook.replace(/^wp_ajax(?:_nopriv)?_/, "");
+    const mapped = mapActionToVuln(action);
+    if (!mapped)
+      continue;
+    const body = functionBody2(code, handler);
+    const hasCapability = body ? /current_user_can|is_user_logged_in|authorize/.test(body) : false;
+    const hasNonce = body ? /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/.test(body) : false;
+    let priority = mapped.weight;
+    if (nopriv)
+      priority += 0.05;
+    if (!hasCapability)
+      priority += 0.05;
+    if (!hasNonce)
+      priority += 0.05;
+    priority = Math.min(1, Number(priority.toFixed(2)));
+    entries.push({
+      hook,
+      action,
+      nopriv,
+      vuln_class: mapped.vuln_class,
+      detector: mapped.detector,
+      examples: mapped.examples,
+      has_capability: hasCapability,
+      has_nonce: hasNonce,
+      priority
+    });
+  }
+  entries.sort((a, b) => b.priority - a.priority);
+  return {
+    actions: entries.length,
+    prioritized: entries.map((e) => ({
+      action: e.action,
+      hook: e.hook,
+      vuln_class: e.vuln_class,
+      detector: e.detector,
+      priority: e.priority,
+      nopriv: e.nopriv,
+      has_capability: e.has_capability,
+      has_nonce: e.has_nonce,
+      examples: e.examples
+    })),
+    top_priority: entries[0] ?? null
+  };
+}
+function functionBody2(code, name) {
+  const idx = code.search(new RegExp(`function\\s+${name}\\s*\\(`));
+  if (idx === -1)
+    return null;
+  const open = code.indexOf("{", idx);
+  if (open === -1)
+    return null;
+  let depth = 0;
+  for (let i = open;i < code.length; i++) {
+    if (code[i] === "{")
+      depth++;
+    else if (code[i] === "}") {
+      depth--;
+      if (depth === 0)
+        return code.slice(open, i + 1);
+    }
+  }
+  return code.slice(open);
+}
+
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
@@ -58136,6 +58335,26 @@ ${statusLine}` : statusLine },
   }, async ({ root, max_files, signature }) => {
     return { content: [{ type: "text", text: JSON.stringify(variantScan(root, { maxFiles: max_files, signature })) }] };
   });
+  server.registerTool("action_surface", {
+    title: "Action-name attack surface (what to look for WHERE)",
+    description: "TARGETING: extract every wp_ajax_* action name, map it to its likely vuln class (upload/import→AFU/RCE, delete/write→file-write, load/download→LFI, login/reset→auth-bypass, exec/run→command injection, settings/update→unauth options change, etc.), cross-reference the hook (nopriv?) + authz gap (nonce/capability present?), and return a DERIVED priority — so the scanner targets the most dangerous action first, instead of scanning blindly.",
+    inputSchema: {
+      code: string2().optional().describe("Source code (PHP) to analyze"),
+      path: string2().optional().describe("OR a source file path")
+    }
+  }, async ({ code, path }) => {
+    let src = code;
+    if (!src && path) {
+      try {
+        src = readFileSync22(path, "utf8");
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
+      }
+    }
+    if (!src)
+      return { content: [{ type: "text", text: JSON.stringify({ error: "provide code or path" }) }] };
+    return { content: [{ type: "text", text: JSON.stringify(actionSurface(src)) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",
@@ -58725,6 +58944,25 @@ ${statusLine}` : statusLine },
     }
     return { content: [{ type: "text", text: JSON.stringify(result) }] };
   });
+  server.registerTool("patch_analyze", {
+    title: "Patch reversal (1-day weaponization)",
+    description: "1-DAY: read a security patch (old vs new code) and REVERSE it — find what the patch ADDED to make the code safer (sanitizer, auth/nonce gate, parameterized query, validation) or REMOVED (a dangerous sink), and reconstruct the vulnerability in the OLD version. Each reversal carries a DERIVED mine_signature to sweep unpatched installs via variant_scan(root, { signature: mine_signature }).",
+    inputSchema: {
+      old_path: string2().optional().describe("Old file path"),
+      new_path: string2().optional().describe("New file path"),
+      old_code: string2().optional().describe("Old source code (when not using paths)"),
+      new_code: string2().optional().describe("New source code (when not using paths)"),
+      language: string2().optional().describe("Language (default php)")
+    }
+  }, async ({ old_path, new_path, old_code, new_code, language }) => {
+    if (old_path && new_path) {
+      return { content: [{ type: "text", text: JSON.stringify(analyzePatchFiles(old_path, new_path, language)) }] };
+    }
+    if (old_code !== undefined && new_code !== undefined) {
+      return { content: [{ type: "text", text: JSON.stringify(analyzePatch(old_code, new_code, language ?? "php")) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify({ error: "provide (old_path+new_path) or (old_code+new_code)" }) }] };
+  });
   server.registerTool("incremental_scan", {
     title: "Incremental scan (CI)",
     description: "EAGLE-EYE: analyze only the files changed between two git refs (default HEAD~1..HEAD) — the fast CI pass. Runs the taint + data-flow engine on just the changed source files and skips unchanged ones; the full-scan path (run_engagement / enrich_scan) remains authoritative.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.37",
+  "version": "2.4.39",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {