blitzstrike 2.4.70 → 2.4.71

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.71] — 2026-09-14
+
+### Added — Rust language support (adapter + detectors)
+
+- Rust is now the 5th taint-engine language (php/javascript/python/java/rust): a new
+  regex/line-oriented adapter maps Rust sources (env::args, stdin, axum/actix
+  Query/Form/Json/Path extractors, env::var) and sinks (std::process::Command,
+  sqlx/diesel/rusqlite, reqwest/hyper, std::fs, serde/bincode) onto the existing
+  sink classes. The sqlx `query!`/`query_as!` compile-time macro + `canonicalize()`
+  are treated as safe (suppressed), so runtime `sqlx::query(&format!(...))` is the
+  signal that fires.
+- Two Rust-specific detectors: `rust_unsafe` (transmute / assume_init /
+  from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and
+  `rust_format_string` (println!/format! with a VARIABLE as the format string —
+  CWE-134, distinct from the safe `println!("{}", v)`).
+- Full pipeline wired: CWE map (66), patterns (24, grounded in RustSec / OWASP
+  WSTG-INPV-13 / Rust Foundation "Unsafe Rust in the Wild" / rust-security-handbook),
+  variants (78), synonyms, severity VRT, coverage matrix (5 languages), and the
+  verification harness (23/23 detectors TP+TN).
+
 ## [2.4.70] — 2026-09-14
 
 ### Added — Per-finding per-scope reports (HackerOne-grade)

package/dist/index.js

@@ -16265,6 +16265,8 @@ function detectComplexBugs(code, file) {
   detectGrpcReflection(code, file, out);
   detectDependencyConfusion(code, file, out);
   detectMlSupplyChain(code, file, out);
+  detectRustUnsafe(code, file, out);
+  detectRustFormatString(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -16753,6 +16755,46 @@ function detectMlSupplyChain(code, file, out) {
     }
   }
 }
+function detectRustUnsafe(code, file, out) {
+  if (!/\.rs$/i.test(file))
+    return;
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const re = /std::mem::transmute|\btransmute\s*\(|\bassume_init\s*\(|from_raw_parts(?:_mut)?\s*\(|ptr::(copy|copy_nonoverlapping|read|write|swap)\s*\(|from_utf8_unchecked\s*\(|\bunreachable_unchecked\s*\(/g;
+  let m;
+  while ((m = re.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    out.push({
+      file,
+      line: ln,
+      type: "rust_unsafe",
+      category: "Rust unsafe / memory-unsafety surface",
+      severity: "medium",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: `\`${m[0]}\` bypasses the borrow checker's memory-safety guarantees — type confusion (transmute), uninitialized reads (assume_init), or unchecked pointer/slice construction (from_raw_parts / ptr::*) can lead to out-of-bounds access, use-after-free, or UB (CWE-119/787/416). Verify the input is bounds-checked and no attacker-controlled length/index reaches it.`
+    });
+  }
+}
+function detectRustFormatString(code, file, out) {
+  if (!/\.rs$/i.test(file))
+    return;
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const re = /\b(format!|println!|print!|eprintln!|eprint!)\s*\(\s*([a-z_][a-z0-9_]*)\s*\)/g;
+  let m;
+  while ((m = re.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    out.push({
+      file,
+      line: ln,
+      type: "rust_format_string",
+      category: "Rust format string injection",
+      severity: "high",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: `\`${m[1]}\` passes a variable (\`${m[2]}\`) as the FORMAT string instead of a literal — if attacker-controlled, format specifiers (positional args, width, precision) can read or corrupt memory (CWE-134). Use \`${m[1]}!("{}", value)\` with the input as an argument, never as the format string.`
+    });
+  }
+}
 var SOURCE_TOKENS3, MAGIC_METHODS, SECRET_FIELD_RE, SECRET_PLACEHOLDER_RE, ENTROPY_EXCLUDE_VAR;
 var init_complex_bugs = __esm(() => {
   init_security_state();
@@ -16948,6 +16990,20 @@ $r = openai.chat.completions.create(['messages' => [['role' => 'user', 'content'
       file: "train.py",
       positive: `import torch\\nmodel = torch.load(downloaded_model)\\n`,
       negative: `import torch\\nmodel = torch.load("model.pt", weights_only=True)\\n`
+    },
+    {
+      id: "rust-unsafe",
+      detector: "rust_unsafe",
+      file: "lib.rs",
+      positive: `fn f() { let x: &[u8] = std::mem::transmute(user_data); }\\n`,
+      negative: `fn f() { let x: &[u8] = user_data.as_bytes(); }\\n`
+    },
+    {
+      id: "rust-format-string",
+      detector: "rust_format_string",
+      file: "main.rs",
+      positive: `fn f() { println!(user_input); }\\n`,
+      negative: `fn f() { println!("{}", user_input); }\\n`
     }
   ];
 });
@@ -56680,10 +56736,97 @@ var javaAdapter = {
     return { sources, sinks, sanitizers, calls, assigns };
   }
 };
+var RUST_SOURCES = [
+  [/env::args\s*\(|args_os\s*\(/, "cli_argument"],
+  [/stdin\s*\(\s*\)|read_line\s*\(/, "raw_body"],
+  [/\b(?:Query|Form|Json|Path)\b|web::(?:Query|Json|Form|Path)|req\.(?:query|params|param|form|query_string)/, "http_parameter"],
+  [/env::var\s*\(|env::var_os\s*\(/, "env_variable"]
+];
+var RUST_SINKS = [
+  [/Command::new|process::Command/, "command_execution", "CWE-78"],
+  [/sqlx::query(?:_as)?\s*\(|sqlx::raw_sql|\.query\s*\(|\.execute\s*\(|rusqlite|diesel::/, "sql_execution", "CWE-89"],
+  [/reqwest::get|reqwest::Client|hyper::|\.get\s*\(|\.post\s*\(|\.put\s*\(|\.request\s*\(/, "http_request", "CWE-918"],
+  [/std::fs::(read_to_string|read|write|remove_file|copy|rename)|File::open\s*\(|fs::(read|write|remove_file|copy)\s*\(/, "path_traversal", "CWE-22"],
+  [/serde_json::from_(str|slice)|bincode::deserialize|serde_yaml::from_str|toml::from_str|\.deserialize\s*\(/, "deserialization", "CWE-502"]
+];
+var RUST_SANITIZERS = [
+  [/canonicalize\s*\(/, ["path_traversal"]],
+  [/query(_as)?!\s*\(/, ["sql_execution"]]
+];
+var rustAdapter = {
+  language: "rust",
+  extensions: [".rs"],
+  parse(code, _file) {
+    const sources = [];
+    const sinks = [];
+    const sanitizers = [];
+    const calls = [];
+    const assigns = [];
+    const assignRe = /let\s+(?:mut\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+?);/g;
+    let m;
+    while ((m = assignRe.exec(code)) !== null) {
+      const varName = m[1];
+      const rhs = m[2];
+      const line = code.slice(0, m.index).split(`
+`).length;
+      const src = RUST_SOURCES.find(([re]) => re.test(rhs));
+      if (src)
+        sources.push({ variable: varName, kind: src[1], line, attacker_controlled: src[1] !== "cli_argument" && src[1] !== "env_variable" });
+      const rhsVars = [];
+      const vre = /([a-z_][a-z0-9_]*)/g;
+      let vm;
+      while ((vm = vre.exec(rhs)) !== null) {
+        const v = vm[1];
+        if (!RUST_SOURCES.some(([re]) => re.test(v)))
+          rhsVars.push(v);
+      }
+      assigns.push({ target: varName, sources: rhsVars.slice(0, 8), line });
+    }
+    const extractorRe = /\b(?:Query|Form|Json|Path)\s*\(\s*([a-z_][a-z0-9_]*)\s*\)/g;
+    while ((m = extractorRe.exec(code)) !== null) {
+      const line = code.slice(0, m.index).split(`
+`).length;
+      sources.push({ variable: m[1], kind: "http_parameter", line, attacker_controlled: true });
+      assigns.push({ target: m[1], sources: [], line });
+    }
+    const lines = code.split(`
+`);
+    for (let i = 0;i < lines.length; i++) {
+      const line = lines[i];
+      for (const [re, kind, cwe] of RUST_SINKS) {
+        if (!re.test(line))
+          continue;
+        if (kind === "sql_execution" && /query(_as)?!\s*\(/.test(line))
+          continue;
+        const argVars = [];
+        const vre = /([a-z_][a-z0-9_]*)/g;
+        let vm;
+        while ((vm = vre.exec(line)) !== null) {
+          const id = vm[1];
+          if (/^(new|let|mut|arg|args|command|process|std|sqlx|query|query_as|execute|reqwest|client|get|post|put|request|fs|file|open|read_to_string|read|write|remove_file|copy|rename|serde_json|from_str|from_slice|bincode|deserialize|toml|yaml|format|unwrap|expect|env|args|stdin|read_line)$/.test(id))
+            continue;
+          argVars.push(id);
+        }
+        for (const v of argVars.slice(0, 8))
+          sinks.push({ variable: v, kind, line: i + 1, cwe });
+      }
+      for (const [re, kinds] of RUST_SANITIZERS) {
+        if (re.test(line)) {
+          const vre = /([a-z_][a-z0-9_]*)/g;
+          let vm;
+          while ((vm = vre.exec(line)) !== null)
+            sanitizers.push({ variable: vm[1], neutralizes: kinds, line: i + 1 });
+        }
+      }
+    }
+    return { sources, sinks, sanitizers, calls, assigns };
+  }
+};
 registerLanguage(phpAdapter);
 registerLanguage(jsAdapter);
 registerLanguage(pythonAdapter);
 registerLanguage(javaAdapter);
+registerLanguage(rustAdapter);
 
 // src/incremental.ts
 var SOURCE_EXTS = [".php", ".phtml", ".js", ".mjs", ".ts", ".tsx", ".py", ".pyw", ".java"];
@@ -58011,7 +58154,14 @@ var ALIASES = {
   "ai supply chain": "ml_supply_chain",
   "model poisoning": "ml_supply_chain",
   "ml security": "ml_supply_chain",
-  "ai ml security": "ml_supply_chain"
+  "ai ml security": "ml_supply_chain",
+  "rust unsafe": "rust_unsafe",
+  "unsafe rust": "rust_unsafe",
+  "rust memory safety": "rust_unsafe",
+  transmute: "rust_unsafe",
+  "rust format string": "rust_format_string",
+  "format string": "rust_format_string",
+  "format string injection": "rust_format_string"
 };
 function normalize(term) {
   return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
@@ -58302,7 +58452,9 @@ var VRT_MAP = {
   oauth_misconfig: { vrt: "authentication > oauth_misconfiguration", priority: "P2", severity: "high", rationale: "An OAuth/open-redirect misconfiguration can leak authorization codes → account takeover." },
   grpc_reflection: { vrt: "misconfiguration > debug_information_exposure", priority: "P5", severity: "low", rationale: "gRPC reflection exposes the API contract but is not directly exploitable." },
   dependency_confusion: { vrt: "insecure_design > dependency_confusion", priority: "P2", severity: "high", rationale: "An internal package resolves from a squattable public registry → attacker-controlled code in the build." },
-  ml_supply_chain: { vrt: "injection > insecure_deserialization", priority: "P1", severity: "critical", rationale: "Untrusted model loading via pickle (torch/joblib/numpy) → arbitrary code execution on load." }
+  ml_supply_chain: { vrt: "injection > insecure_deserialization", priority: "P1", severity: "critical", rationale: "Untrusted model loading via pickle (torch/joblib/numpy) → arbitrary code execution on load." },
+  rust_unsafe: { vrt: "insecure_design > unsafe_memory_operations", priority: "P3", severity: "medium", rationale: "transmute/from_raw_parts/assume_init bypass the borrow checker — a hint that needs bounds verification; memory corruption if attacker-controlled." },
+  rust_format_string: { vrt: "injection > format_string_injection", priority: "P2", severity: "high", rationale: "An attacker-controlled format string can read or corrupt memory via format specifiers." }
 };
 function severityCalibrate(input) {
   const type = input.type?.toLowerCase() ?? "";
@@ -59758,11 +59910,29 @@ var JAVA_SINKS2 = {
   xpath_injection: true,
   ldap_injection: true
 };
+var RUST_SINKS2 = {
+  sql_execution: true,
+  code_execution: false,
+  command_execution: true,
+  file_operations: true,
+  file_inclusion: false,
+  deserialization: true,
+  http_request: true,
+  redirect: true,
+  html_render: false,
+  xml_processing: false,
+  archive_extraction: false,
+  path_traversal: true,
+  template_injection: false,
+  xpath_injection: false,
+  ldap_injection: false
+};
 var SINK_BY_LANG = {
   php: PHP_SINKS2,
   javascript: JS_SINKS2,
   python: PY_SINKS2,
-  java: JAVA_SINKS2
+  java: JAVA_SINKS2,
+  rust: RUST_SINKS2
 };
 function coverageMatrix() {
   const langs = listLanguages();
@@ -59822,7 +59992,7 @@ function createServer() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE).\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed).\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."

package/intelligence/cwe_map.json

@@ -320,6 +320,16 @@
       "id": "ml_supply_chain",
       "cwe": "CWE-502",
       "name": "Deserialization of Untrusted Data"
+    },
+    {
+      "id": "rust_unsafe",
+      "cwe": "CWE-119",
+      "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
+    },
+    {
+      "id": "rust_format_string",
+      "cwe": "CWE-134",
+      "name": "Use of Externally-Controlled Format String"
     }
   ]
 }

package/intelligence/patterns.json

@@ -634,6 +634,63 @@
         "training data / weights",
         "the inference API surface"
       ]
+    },
+    {
+      "id": "rust_unsafe",
+      "cwe": "CWE-119",
+      "real_world": "A Rust library uses std::mem::transmute to reinterpret an attacker-influenced value as a reference, or builds a slice via from_raw_parts with a caller-supplied length, producing out-of-bounds access / use-after-free inside an unsafe block.",
+      "detection_signatures": [
+        "std::mem::transmute(...)",
+        "MaybeUninit::assume_init()",
+        "from_raw_parts(ptr, len)",
+        "ptr::copy / ptr::copy_nonoverlapping / ptr::read / ptr::write",
+        "from_utf8_unchecked / unreachable_unchecked"
+      ],
+      "chain_templates": [],
+      "references": [
+        "CWE-119",
+        "CWE-787",
+        "CWE-416",
+        "Rust Foundation — Unsafe Rust in the Wild",
+        "guardsarm/rust-memory-safety-examples",
+        "doc.rust-lang.org/rustc/exploit-mitigations.html"
+      ],
+      "bypass_techniques": [
+        "transmute to a larger/smaller layout to defeat the borrow checker",
+        "from_raw_parts with an attacker-controlled length",
+        "unsafe + raw pointer arithmetic past the bounds",
+        "FFI (extern C) without validating C-side lengths"
+      ],
+      "crown_jewels": [
+        "any host RCE / memory corruption",
+        "the unsafe block's invariants (what must hold for soundness)",
+        "FFI boundaries (the highest-yield audit surface)"
+      ]
+    },
+    {
+      "id": "rust_format_string",
+      "cwe": "CWE-134",
+      "real_world": "A server logs or prints a user-supplied string as the format argument — println!(user_input) — so the attacker's format specifiers (positional args, width/precision) read or corrupt memory.",
+      "detection_signatures": [
+        "format!(var) / println!(var) / print!(var) / eprintln!(var) with a VARIABLE as the format string (not a literal)"
+      ],
+      "chain_templates": [],
+      "references": [
+        "CWE-134",
+        "OWASP WSTG-INPV-13 Format String Injection",
+        "yevh/rust-security-handbook (injection attack prevention)",
+        "StackHawk — Rust command injection examples"
+      ],
+      "bypass_techniques": [
+        "width/precision specifiers to read past the intended argument",
+        "positional args ({0} {1} ...) to reach unintended arguments",
+        "indirect format via a helper that passes user input straight into format!"
+      ],
+      "crown_jewels": [
+        "the formatting arguments on the stack",
+        "any panic path that formats attacker input",
+        "logging/telemetry that echoes request data"
+      ]
     }
   ]
 }

package/intelligence/variants.json

@@ -374,6 +374,30 @@
       "class": "ml_supply_chain",
       "code": "arr = np.load(path, allow_pickle=True)",
       "note": "np.load allow_pickle=True"
+    },
+    {
+      "class": "rust_unsafe",
+      "code": "let x: &[u8] = std::mem::transmute(user_data);",
+      "note": "transmute attacker data",
+      "file": "lib.rs"
+    },
+    {
+      "class": "rust_unsafe",
+      "code": "let s = unsafe { std::slice::from_raw_parts(ptr, user_len) };",
+      "note": "from_raw_parts with caller length",
+      "file": "lib.rs"
+    },
+    {
+      "class": "rust_format_string",
+      "code": "println!(user_input);",
+      "note": "variable as format string",
+      "file": "main.rs"
+    },
+    {
+      "class": "rust_format_string",
+      "code": "let s = format!(user_msg);",
+      "note": "format! with variable",
+      "file": "main.rs"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.70",
+  "version": "2.4.71",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {