blitzstrike 2.4.45 → 2.4.47

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.47] — 2026-09-14
+
+### Changed — WordPress integration coverage is now COMPLETE (class-method + direct handlers)
+
+- The WP authz/nonce detector previously only matched STRING handlers
+  (`add_action('wp_ajax_x','fn')`), missing the `array($this,'method')` /
+  `array('Class','method')` form that dominates modern class-based plugins.
+  Now resolves any handler form via `handlerName()` + `functionBody()`.
+- Added raw request-handler detection: `add_action('init'|'admin_init'|
+  'wp_loaded'|'template_redirect', ...)` that reads request input directly —
+  flagged for missing nonce (CSRF) and missing capability (privileged ops).
+- Auth surface widened (`is_admin`, `is_super_admin`, `current_user_can_edit_post`,
+  `wp_doing_ajax`). Benchmark: elementor 0→11, forminator ~3→90, learnpress 1→11
+  authz/nonce findings (class-method handlers now visible).
+
+## [2.4.46] — 2026-09-14
+
+### Added — SQL injection (raw string-interpolated query) detector
+
+- `detectSqlInjection` (in complex-bugs.ts): flags a SQL sink (`$wpdb->get_results/
+  get_col/get_var/get_row/query`, `->query`, `DB::unprepared`, `->whereRaw`,
+  `->selectRaw`) whose query is built by string concatenation (`. $var`) and NOT
+  `->prepare()`d — targeting the CROSS-FILE case the per-file taint engine cannot
+  see (source in a caller). Surfaces the raw-concat sink as a lead to trace back.
+- Enterprise fixture `wp-batch-route` corrected to 2 vulns (route confusion +
+  the raw SQLi in `get_users`) — the new detector surfaced a real, previously
+  uncounted vuln.
+
 ## [2.4.45] — 2026-09-14
 
 ### Added — File Upload → RCE detector (from plugin benchmark)

package/dist/index.js

@@ -56471,43 +56471,55 @@ function functionBody(code, name) {
   }
   return code.slice(open);
 }
+function handlerName(expr) {
+  const quoted = expr.match(/['"]([A-Za-z_][A-Za-z0-9_]*)['"]/g);
+  if (quoted && quoted.length > 0)
+    return quoted[quoted.length - 1].replace(/['"]/g, "");
+  return null;
+}
 var INDIRECT_AUTH = /\b[a-zA-Z0-9_]*(auth|permission|cap|nonce|can_|check|verify|allow)[a-zA-Z0-9_]*\s*\(/;
+var AUTH_RE = /current_user_can|is_user_logged_in|is_admin\b|is_super_admin|current_user_can_edit_post|authorize|wp_doing_ajax/;
+var NONCE_RE = /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/;
 function detectWpAuthz(code, file, out) {
-  const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
+  const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*(.+?)\s*\)/g;
   let m;
   while ((m = ajaxRe.exec(code)) !== null) {
     const hook = m[1];
-    const handler = m[2];
+    const handler = handlerName(m[2]);
+    if (!handler)
+      continue;
     const nopriv = hook.startsWith("wp_ajax_nopriv_");
     const body = functionBody(code, handler);
     if (!body)
       continue;
-    const hasCap = /current_user_can|is_user_logged_in|authorize/.test(body) || INDIRECT_AUTH.test(body);
-    const hasNonce = /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/.test(body);
+    const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = NONCE_RE.test(body);
     const line = lineNoOf(code, m.index);
     if (nopriv && !hasCap) {
-      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated AJAX handler)", severity: "high", evidence: `add_action('${hook}', '${handler}')`, detail: `Unauthenticated AJAX handler '${handler}()' performs no current_user_can()/authorization check — any unauthenticated visitor can trigger it (auth bypass / privilege escalation).` });
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated AJAX handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated AJAX handler '${handler}()' performs no current_user_can()/authorization check — any unauthenticated visitor can trigger it (auth bypass / privilege escalation).` });
     }
     if (!hasNonce) {
-      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', '${handler}')`, detail: `AJAX handler '${handler}()' does not verify a nonce (wp_verify_nonce / check_ajax_referer) — CSRF.` });
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `AJAX handler '${handler}()' does not verify a nonce (wp_verify_nonce / check_ajax_referer) — CSRF.` });
     }
   }
-  const adminRe = /add_action\s*\(\s*['"](admin_post(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
+  const adminRe = /add_action\s*\(\s*['"](admin_post(?:_nopriv)?_\w+)['"]\s*,\s*(.+?)\s*\)/g;
   while ((m = adminRe.exec(code)) !== null) {
     const hook = m[1];
-    const handler = m[2];
+    const handler = handlerName(m[2]);
+    if (!handler)
+      continue;
     const nopriv = hook.startsWith("admin_post_nopriv_");
     const body = functionBody(code, handler);
     if (!body)
       continue;
-    const hasCap = /current_user_can|is_user_logged_in|authorize/.test(body) || INDIRECT_AUTH.test(body);
-    const hasNonce = /wp_verify_nonce|check_admin_referer|verify_nonce/.test(body);
+    const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = NONCE_RE.test(body);
     const line = lineNoOf(code, m.index);
     if (nopriv && !hasCap) {
-      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated admin-post handler)", severity: "high", evidence: `add_action('${hook}', '${handler}')`, detail: `Unauthenticated admin-post handler '${handler}()' has no authorization check — auth bypass / privilege escalation.` });
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated admin-post handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated admin-post handler '${handler}()' has no authorization check — auth bypass / privilege escalation.` });
     }
     if (!hasNonce) {
-      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', '${handler}')`, detail: `admin-post handler '${handler}()' does not verify a nonce — CSRF.` });
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `admin-post handler '${handler}()' does not verify a nonce — CSRF.` });
     }
   }
   const restRe = /register_rest_route\s*\(\s*['"]([^'"]+)['"]\s*,\s*['"]([^'"]+)['"]/g;
@@ -56518,6 +56530,27 @@ function detectWpAuthz(code, file, out) {
       continue;
     out.push({ file, line, type: "missing_authz", category: "REST route missing permission_callback", severity: "high", evidence: `register_rest_route('${m[1]}', '${m[2]}')`, detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass).` });
   }
+  const formRe = /add_action\s*\(\s*['"](init|admin_init|wp_loaded|template_redirect|parse_request|wp)['"]\s*,\s*(.+?)\s*\)/g;
+  while ((m = formRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = handlerName(m[2]);
+    if (!handler)
+      continue;
+    const body = functionBody(code, handler);
+    if (!body)
+      continue;
+    if (!/\$_(GET|POST|REQUEST|COOKIE|SERVER)\b|php:\/\/input|filter_input|file_get_contents\(['"]php:\/\/input/.test(body))
+      continue;
+    const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = NONCE_RE.test(body);
+    const line = lineNoOf(code, m.index);
+    if (!hasNonce) {
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification (direct request handler)", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `Request handler '${handler}()' (on '${hook}') reads request input without nonce verification — CSRF.` });
+    }
+    if (!hasCap && /(update_option|add_option|delete_option|wp_insert_post|wp_update_post|wp_delete_post|update_user_meta|delete_user_meta|wp_set_current_user|wp_mail|wp_handle_upload|move_uploaded_file|wp_delete_user|add_user|wp_create_user|set_user_role|wp_redirect\s*\(\s*['"]admin)/.test(body)) {
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (direct request handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Request handler '${handler}()' (on '${hook}') performs a privileged/state-changing operation with no capability check — auth bypass / privilege escalation.` });
+    }
+  }
 }
 var ROUTE_DETECTORS = [
   { framework: "laravel", entry: /Route::(?:get|post|put|patch|delete|any|match|resource)\s*\(\s*['"][^'"]+['"]/g, auth: /->middleware\s*\(\s*['"]auth|middleware\s*\(\s*\[[^\]]*['"]auth|->can\s*\(|\$this->authorize|Gate::|authorize\s*\(|@can\b/, window: 2 },
@@ -56679,6 +56712,7 @@ function detectComplexBugs(code, file) {
   detectXxe(code, file, out);
   detectSsti(code, file, out);
   detectFileUploadRce(code, file, out);
+  detectSqlInjection(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -56864,6 +56898,34 @@ function detectFileUploadRce(code, file, out) {
     });
   }
 }
+function detectSqlInjection(code, file, out) {
+  const ls = lines2(code);
+  const sinkRe = /\$wpdb->(get_results|get_col|get_var|get_row|query)\s*\(|->query\s*\(|DB::unprepared\s*\(|->whereRaw\s*\(|->selectRaw\s*\(/g;
+  let m;
+  while ((m = sinkRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 6), ln + 1).join(`
+`);
+    if (/->prepare\s*\(/.test(scope))
+      continue;
+    if (SOURCE_TOKENS3.test(scope))
+      continue;
+    const inlineConcat = /\.\s*\$[A-Za-z_]\w*/.test(l);
+    const assignConcat = /(?:^|\n)\s*\$[A-Za-z_]\w*\s*(?:\.=|=)\s*[^;\n]*["'][^"']*["']\s*\.\s*\$[A-Za-z_]\w*/.test(scope);
+    if (!inlineConcat && !assignConcat)
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "sql_injection",
+      category: "SQL injection (raw string-interpolated query)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "A SQL sink receives a query built by string concatenation (not prepared), with no visible source in this file — trace the concatenated variable back to a request source; if user-controlled, this is SQL injection (CWE-89)."
+    });
+  }
+}
 
 // src/guidance.ts
 var SINK_DIRECTIVES = {
@@ -57887,7 +57949,7 @@ var ENTERPRISE_FIXTURES = [
   { id: "js-express", dir: join18(ROOT6, "js-express"), expected_vulns: 2 },
   { id: "py-django", dir: join18(ROOT6, "py-django"), expected_vulns: 2 },
   { id: "java-spring", dir: join18(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join18(ROOT6, "wp-batch-route"), expected_vulns: 1 },
+  { id: "wp-batch-route", dir: join18(ROOT6, "wp-batch-route"), expected_vulns: 2 },
   { id: "php-complex", dir: join18(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.45",
+  "version": "2.4.47",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {