blitzstrike 2.4.53 → 2.4.54

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.54] — 2026-09-14
+
+### Changed — file-upload scope widened + antiscript-not-a-defense regression
+
+- Widened the file-upload defense scope from 6 to 30 lines so a nearby
+  extension whitelist / wp_check_filetype is still seen.
+- Regression test: `wpcf7_antiscript_file_name` (extension-strip) is NOT a
+  defense signal — CF7 CVE-2020-35489 was a filename special-char issue and the
+  vulnerable 5.3.1 also calls it; treating antiscript as a defense caused a
+  false negative. Remaining file-upload FPs (2/19 clean plugins) are cross-file
+  validation or admin-only context — inherent to per-file detection.
+
 ## [2.4.53] — 2026-09-14
 
 ### Changed — file-upload precision (FP-reduction from a 19-plugin clean corpus)

package/dist/index.js

@@ -56945,9 +56945,9 @@ function detectFileUploadRce(code, file, out) {
   while ((m = re.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
     const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 6), ln + 2).join(`
+    const scope = ls.slice(Math.max(0, ln - 30), ln + 3).join(`
 `);
-    if (!/\$_FILES\b|tmp_name|getUploadedFile|uploadedFile|\[['"]name['"]\]/i.test(scope))
+    if (!/\$_FILES\b|tmp_name|getUploadedFile|uploadedFile|\['name'\]/i.test(scope))
       continue;
     if (/(wp_check_filetype|PATHINFO_EXTENSION|wp_get_mime_types|allowed_?(types|extensions|exts)|mime_?(types|extensions)|in_array\s*\([^)]*\$(?:allowed|whitelist|ext)|wp_handle_upload\s*\(\s*[^)]*test_form\s*=>\s*true)/i.test(scope))
       continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.53",
+  "version": "2.4.54",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {