blitzstrike 2.4.59 → 2.4.60

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.60] — 2026-09-14
+
+### Added — Modern attack-surface detectors + verification corpus
+
+- Four new detector classes (the "next-gen" 2026 surface beyond classic web):
+  `llm_injection` (request input reaches an LLM call — OWASP LLM01), `graphql_exposure`
+  (introspection/playground left on), `oauth_misconfig` (redirect_uri fed by request
+  input with no allowlist), and `grpc_reflection` (reflection enabled). Each carries
+  CWE mapping + empirical pattern grounding.
+- New `bench/verification/` — an auditable verification corpus: every detector that
+  was verified against a real vulnerable target gets a writeup (detector → ground
+  truth → result → evidence). "Battle-tested" is now a claim with an audit trail,
+  not an assertion.
+
 ## [2.4.59] — 2026-09-14
 
 ### Added — Severity calibration + engagement scaffold + data health

package/dist/index.js

@@ -56852,6 +56852,10 @@ function detectComplexBugs(code, file) {
   detectUnrestrictedUpload(code, file, out);
   detectSqlInjection(code, file, out);
   detectHardcodedSecret(code, file, out);
+  detectLlmInjection(code, file, out);
+  detectGraphqlExposure(code, file, out);
+  detectOauthMisconfig(code, file, out);
+  detectGrpcReflection(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -57174,6 +57178,91 @@ function detectHardcodedSecret(code, file, out) {
     }
   }
 }
+function detectLlmInjection(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const llmCallRe = /\b(?:openai|anthropic|langchain|llama_index)\.[A-Za-z_.]+\s*\(|\b(?:ChatCompletion|completion|messages)\.create\s*\(|\bllm\.invoke\s*\(|\.chat\.completions\.create\s*\(/g;
+  let m;
+  while ((m = llmCallRe.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const scope = ls.slice(Math.max(0, ln - 6), ln + 3).join(`
+`);
+    if (!SOURCE_TOKENS3.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "llm_injection",
+      category: "LLM prompt injection surface",
+      severity: "medium",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: "Request input reaches an LLM call (chat/completion/invoke) with no visible prompt-injection boundary — untrusted text may override instructions or exfiltrate context (OWASP LLM01 Prompt Injection). Verify the prompt is sandboxed and output is not used for privileged actions."
+    });
+  }
+}
+function detectGraphqlExposure(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const re = /\b(introspection|playground|graphiql)\s*[:=]\s*(true|1)\b/gi;
+  let m;
+  while ((m = re.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    out.push({
+      file,
+      line: ln,
+      type: "graphql_exposure",
+      category: "GraphQL introspection/playground exposed",
+      severity: "medium",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: `GraphQL ${m[1].toLowerCase()} is enabled (${m[2]}) in a configuration that appears production-reachable — introspection exposes the full schema/fields, and a playground enables interactive querying (CWE-200 Information Exposure). Disable in production.`
+    });
+  }
+}
+function detectOauthMisconfig(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const re = /\b(redirect_uri|redirectUrl|return_url|returnUrl|callback_url)\s*[:=]\s*/gi;
+  let m;
+  while ((m = re.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const rest = clean.slice(m.index + m[0].length);
+    const lineEnd = rest.search(/\r?\n/);
+    const line = lineEnd === -1 ? rest : rest.slice(0, lineEnd);
+    if (!/(request|params|query|\$_(?:GET|POST|REQUEST)|req\.)/i.test(line))
+      continue;
+    const scope = ls.slice(Math.max(0, ln - 6), ln + 3).join(`
+`);
+    if (/(allowlist|whitelist|allowed_|in_array|startsWith|===\s*['"])/.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "oauth_misconfig",
+      category: "OAuth redirect_uri misconfiguration",
+      severity: "high",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: "An OAuth redirect_uri/callback is fed by request input with no allowlist validation — an attacker can redirect the authorization code/token to an attacker-controlled endpoint (CWE-601 Open Redirect → token theft). Validate the redirect target against a static allowlist."
+    });
+  }
+}
+function detectGrpcReflection(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const re = /\b(enable_server_reflection|RegisterReflectionService|reflection\.enable|grpc_reflection|reflection\.Register)\b/gi;
+  let m;
+  while ((m = re.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    out.push({
+      file,
+      line: ln,
+      type: "grpc_reflection",
+      category: "gRPC reflection exposed",
+      severity: "low",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: "gRPC server reflection is enabled — it enumerates every service/method to any caller, expanding the attack surface and leaking the API contract (CWE-200 Information Exposure). Disable reflection in production."
+    });
+  }
+}
 
 // src/guidance.ts
 var SINK_DIRECTIVES = {

package/intelligence/cwe_map.json

@@ -58,6 +58,10 @@
     {"id": "hardcoded_secret", "cwe": "CWE-798", "name": "Use of Hard-coded Credentials"},
     {"id": "type_juggling", "cwe": "CWE-697", "name": "Incorrect Comparison"},
     {"id": "path_confusion", "cwe": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"},
-    {"id": "wrong_sanitizer", "cwe": "CWE-20", "name": "Improper Input Validation"}
+    {"id": "wrong_sanitizer", "cwe": "CWE-20", "name": "Improper Input Validation"},
+    {"id": "llm_injection", "cwe": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command (LLM Prompt Injection)"},
+    {"id": "graphql_exposure", "cwe": "CWE-200", "name": "Exposure of Sensitive Information"},
+    {"id": "oauth_misconfig", "cwe": "CWE-601", "name": "URL Redirection to Untrusted Site (Open Redirect)"},
+    {"id": "grpc_reflection", "cwe": "CWE-200", "name": "Exposure of Sensitive Information"}
   ]
 }

package/intelligence/patterns.json

@@ -146,6 +146,42 @@
       "detection_signatures": ["secret field assigned a literal", "known secret format (JWT/AWS/GitHub/Slack/…) in source", "high-entropy token under a non-obvious name"],
       "chain_templates": ["api_key_leak_to_account_takeover", "appkey_leak_deserialization_rce", "default_creds_to_internal_pivot"],
       "references": ["CWE-798", "OWASP A02:2021 Cryptographic Failures"]
+    },
+    {
+      "id": "llm_injection",
+      "name": "LLM Prompt Injection",
+      "cwe": "CWE-77",
+      "real_world": "Untrusted text reaches an LLM call (chat/completion/invoke) without a prompt-injection boundary, letting the input override instructions, leak the system prompt, or steer the model into a privileged action.",
+      "detection_signatures": ["an LLM provider call (openai/anthropic/langchain/llm) with request input in scope", "no visible system-prompt boundary or output filtering"],
+      "chain_templates": [],
+      "references": ["CWE-77", "OWASP LLM01:2025 Prompt Injection"]
+    },
+    {
+      "id": "graphql_exposure",
+      "name": "GraphQL Introspection / Playground Exposure",
+      "cwe": "CWE-200",
+      "real_world": "GraphQL introspection or a playground is left enabled in production, exposing the full schema (every query/mutation/field) and enabling interactive querying for recon.",
+      "detection_signatures": ["introspection/playground/graphiql set true in a production-reachable config"],
+      "chain_templates": ["graphql_idor_to_data_theft", "graphql_batching_to_credential_stuffing"],
+      "references": ["CWE-200", "OWASP API2:2023 Broken Authentication"]
+    },
+    {
+      "id": "oauth_misconfig",
+      "name": "OAuth Redirect URI Misconfiguration",
+      "cwe": "CWE-601",
+      "real_world": "An OAuth redirect_uri/callback is fed by request input with no static allowlist, letting an attacker redirect the authorization code or token to an attacker-controlled endpoint.",
+      "detection_signatures": ["redirect_uri/callback fed by request input", "no allowlist/whitelist validation nearby"],
+      "chain_templates": ["oauth_redirect_bypass", "open_redirect_to_oauth_theft"],
+      "references": ["CWE-601", "OWASP A07:2021 Identification and Authentication Failures"]
+    },
+    {
+      "id": "grpc_reflection",
+      "name": "gRPC Reflection Exposed",
+      "cwe": "CWE-200",
+      "real_world": "gRPC server reflection is enabled, enumerating every service and method to any caller and leaking the API contract.",
+      "detection_signatures": ["enable_server_reflection / RegisterReflectionService in production code"],
+      "chain_templates": [],
+      "references": ["CWE-200"]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.59",
+  "version": "2.4.60",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {