blitzstrike 2.4.74 → 2.4.76

package/CHANGELOG.md

@@ -5,6 +5,45 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.76] — 2026-09-17
+
+### Fixed — config/manifest files were not scanned (whole-class FN)
+
+- `iterSourceFiles` only walked code extensions (php/py/js/ts/...), so the
+  detectors never saw nginx configs, manifests, or other-language sources.
+  Added `.conf/.config/.nginx`, `.json/.yaml/.yml/.toml/.xml/.properties/.gradle/.proto`,
+  `.env/.txt`, and `.rb/.go/.rs/.cs/.c/.h/.cpp/.cc/.hpp/.sh/.bash`. This unblocks
+  `cache_deception` (nginx.conf — caught labs01) and `dependency_confusion` /
+  `oauth_misconfig` / `grpc_reflection` (package.json / requirements.txt / yaml).
+
+## [2.4.75] — 2026-09-17
+
+### Fixed — detection FP/FN remediation (Hackbot Arena benchmark-driven)
+
+Four fixes driven by the 30-lab detection benchmark (TP/FP/FN):
+
+1. **`detectRouteAuthz` decorator/middleware auth + public-route skip.**
+   Recognizes `require_auth` / `auth_required` / `jwt_required` / `token_required` /
+   `verify_token` / `current_user` / `before_request` as auth enforcement; skips
+   public-by-design routes (register/login/health/status/static/docs/...). Also
+   fixed a cross-framework FP: the express detector was matching Flask
+   `@app.get/post` decorators (no `@` exclusion) — added `(?<!@)` and expanded the
+   flask entry to `@app.(route|get|post|put|delete|patch)`. `missing_authz` FP
+   dropped ~23 → 19 labs.
+2. **Node/Python sinks.** Added `subprocess.run/call/Popen/check_output`,
+   `os.system/popen`, `child_process.exec/spawn/execSync`, `sqlx::query(&format!`,
+   `sequelize.query`, `knex.raw`, `requests.get/post/put`, `urllib.request.urlopen`,
+   `httpx.get`, `render_template_string`/`Template` to the sink scanner — so Python
+   command injection (labs24), SSRF (labs07/10/15), and Node SQLi now register.
+3. **Two new detectors.** `jwt_alg_confusion` (verifier accepting RS256 + HS256
+   with public-key HMAC — CWE-347, caught labs03) and `cache_deception`
+   (cookie-less static cache key over a session-authenticated backend — CWE-525,
+   caught labs01). Also enhanced `ssti` to catch Liquid `Template(var)` from stored
+   input (labs23). Both wired through cwe_map/patterns/severity/synonyms/harness.
+4. **`hardcoded_secret` flag suppression.** Suppresses `FLAG{...}` literals, the
+   bare `FLAG` env marker, and quoted-prefix concatenations (`'usr_' + random`) so
+   seeded CTF flags and runtime-built values aren't reported as CWE-798.
+
 ## [2.4.74] — 2026-09-17
 
 ### Fixed — live_recon tech fingerprint false-positive (benchmark-driven)

package/dist/index.js

@@ -7228,7 +7228,30 @@ var init_scanner = __esm(() => {
     "print ": "XSS (reflected output)",
     "printf(": "XSS (reflected output)",
     "header(": "Open redirect / header injection",
-    "wp_redirect(": "Open redirect"
+    "wp_redirect(": "Open redirect",
+    "child_process.exec(": "RCE (command execution)",
+    "child_process.spawn(": "RCE (command execution)",
+    "child_process.execSync(": "RCE (command execution)",
+    "child_process.execFile(": "RCE (command execution)",
+    "sqlx::query(&format!": "SQL injection (runtime string-built query)",
+    "sqlx::query_as(&format!": "SQL injection (runtime string-built query)",
+    "sequelize.query(": "SQL injection (raw query)",
+    "knex.raw(": "SQL injection (raw query)",
+    "subprocess.run(": "RCE (command execution)",
+    "subprocess.call(": "RCE (command execution)",
+    "subprocess.Popen(": "RCE (command execution)",
+    "subprocess.check_output(": "RCE (command execution)",
+    "os.system(": "RCE (command execution)",
+    "os.popen(": "RCE (command execution)",
+    "requests.get(": "SSRF (unvalidated URL fetch)",
+    "requests.post(": "SSRF (unvalidated URL fetch)",
+    "requests.put(": "SSRF (unvalidated URL fetch)",
+    "urllib.request.urlopen(": "SSRF (unvalidated URL fetch)",
+    "urllib.urlopen(": "SSRF (unvalidated URL fetch)",
+    "httpx.get(": "SSRF (unvalidated URL fetch)",
+    "render_template_string(": "SSTI (server-side template injection)",
+    "jinja2.Template(": "SSTI (server-side template injection)",
+    "Template(": "SSTI (server-side template injection)"
   };
   AUTH_GATES = [
     "check_ajax_referer",
@@ -7257,7 +7280,31 @@ var init_scanner = __esm(() => {
     ".mjs",
     ".cjs",
     ".ts",
-    ".tsx"
+    ".tsx",
+    ".rb",
+    ".go",
+    ".rs",
+    ".cs",
+    ".c",
+    ".h",
+    ".cpp",
+    ".cc",
+    ".hpp",
+    ".sh",
+    ".bash",
+    ".conf",
+    ".config",
+    ".nginx",
+    ".json",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".xml",
+    ".properties",
+    ".gradle",
+    ".proto",
+    ".env",
+    ".txt"
   ]);
   SKIP_PARTS = new Set(["vendor", "node_modules", ".git", "tests", "test"]);
   LIB_PARTS = new Set([
@@ -15934,6 +15981,8 @@ function detectRouteAuthz(code, file, out) {
       const ln = lineNoOf(code, m.index);
       const window2 = ls.slice(Math.max(0, ln - d.window), Math.min(ls.length, ln + d.window + 1)).join(`
 `);
+      if (PUBLIC_ROUTE_RE.test(m[0] + " " + window2))
+        continue;
       if (d.auth.test(window2))
         continue;
       out.push({
@@ -15961,7 +16010,7 @@ function detectMissingAuthz(code, file) {
     return true;
   });
 }
-var FRAMEWORKS, INDIRECT_AUTH, AUTH_RE, NONCE_RE, DANGEROUS_OP_RE, ROUTE_DETECTORS;
+var FRAMEWORKS, INDIRECT_AUTH, AUTH_RE, NONCE_RE, DANGEROUS_OP_RE, ROUTE_DETECTORS, PUBLIC_ROUTE_RE;
 var init_framework_security = __esm(() => {
   FRAMEWORKS = {
     wordpress: {
@@ -16042,13 +16091,14 @@ var init_framework_security = __esm(() => {
   ROUTE_DETECTORS = [
     { framework: "laravel", entry: /Route::(?:get|post|put|patch|delete|any|match|resource)\s*\(\s*['"][^'"]+['"]/g, auth: /->middleware\s*\(\s*['"]auth|middleware\s*\(\s*\[[^\]]*['"]auth|->can\s*\(|\$this->authorize|Gate::|authorize\s*\(|@can\b/, window: 2 },
     { framework: "django", entry: /@api_view\s*\(|def\s+\w+\s*\(\s*request\s*[,)]/g, auth: /login_required|permission_required|user_passes_test|LoginRequiredMixin|PermissionRequiredMixin|permission_classes|IsAuthenticated|has_permission/, window: 3 },
-    { framework: "flask", entry: /@(?:app|bp|blueprint)\.route\s*\(/g, auth: /login_required|current_user\.is_authenticated|permission_required/, window: 3 },
-    { framework: "express", entry: /(?:app|router)\.(?:get|post|put|delete|patch|use)\s*\(\s*['"][^'"]+['"]/g, auth: /requireAuth|authenticate|passport\.authenticate|req\.user|isAuthenticated|ensureAuthenticated|requireLogin|\.authorize|authMiddleware/, window: 2 },
+    { framework: "flask", entry: /@(?:app|bp|blueprint)\.(?:route|get|post|put|delete|patch|before_request)\s*\(/g, auth: /login_required|require_auth|auth_required|jwt_required|token_required|current_user|is_authenticated|before_request|verify_token|permission_required/, window: 3 },
+    { framework: "express", entry: /(?<!@)(?:app|router)\.(?:get|post|put|delete|patch|use)\s*\(\s*['"][^'"]+['"]/g, auth: /requireAuth|require_auth|authenticate|passport\.authenticate|req\.user|isAuthenticated|ensureAuthenticated|requireLogin|\.authorize|authMiddleware|verifyToken|verify_token|jwt\.verify/, window: 2 },
     { framework: "spring", entry: /@(?:Get|Post|Put|Delete|Patch|Request)Mapping\s*\(/g, auth: /@PreAuthorize|@Secured|@RolesAllowed|hasRole|hasAuthority|isAuthenticated|SecurityContextHolder/, window: 2 },
     { framework: "symfony", entry: /#\[(?:Route|Get|Post|Put|Delete|Patch)\b|@Route\s*\(/g, auth: /is_granted|denyAccessUnlessGranted|->isGranted\s*\(|IsGranted|Voter/, window: 2 },
     { framework: "aspnet", entry: /\[Http(?:Get|Post|Put|Delete|Patch)\b/g, auth: /\[Authorize|User\.Identity|IsInRole|AuthorizeAsync|\[AllowAnonymous|IAuthorizationService/, window: 2 },
     { framework: "rails", entry: /class\s+\w+\s*<\s*ApplicationController/g, auth: /before_action\s+:authenticate|before_action\s+:authorize|authenticate_user!|authorize\s+|current_user|authenticate/, window: 6 }
   ];
+  PUBLIC_ROUTE_RE = /['"`]\/?(?:(?:api|v1|v2|o|auth|adminapi)\/)?(?:register|login|logout|signup|signin|forgot-password|reset-password|health|healthz|ready|status|version|ping|static|public|assets|css|js|img|favicon|echo|config|docs|openapi|swagger|robots|sitemap|graphql|graphiql|query|upload|callback|webhook)[/'"?]|['"`]\/?['"`]$/i;
 });
 
 // src/complex-bugs.ts
@@ -16267,6 +16317,8 @@ function detectComplexBugs(code, file) {
   detectMlSupplyChain(code, file, out);
   detectRustUnsafe(code, file, out);
   detectRustFormatString(code, file, out);
+  detectJwtAlgConfusion(code, file, out);
+  detectCacheDeception(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -16427,6 +16479,21 @@ function detectSsti(code, file, out) {
       detail: "User input reaches a template render with no sandbox — SSTI (`{{7*7}}`, `${7*7}`, `#{7*7}`) → RCE."
     });
   }
+  if (/from\s+liquid\s+import\s+Template|liquid\.Template|import\s+liquid/.test(code)) {
+    const tRe = /\bTemplate\s*\(\s*([a-z_][a-z0-9_]*)\s*\)/g;
+    while ((m = tRe.exec(code)) !== null) {
+      const ln = lineNo2(code, m.index);
+      out.push({
+        file,
+        line: ln,
+        type: "ssti",
+        category: "SSTI (Liquid template source from stored input)",
+        severity: "high",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: "A Liquid template is compiled from a variable (`Template(var)`) with no template-syntax screening — profile/stored input becomes template source, so `{{ ... }}` tags execute server-side (SSTI → data exfiltration / RCE). Render with an explicit, static template and pass user values only as variables."
+      });
+    }
+  }
 }
 function detectFileUploadRce(code, file, out) {
   code = stripCommentsOnly(code);
@@ -16525,6 +16592,10 @@ function detectHardcodedSecret(code, file, out) {
       continue;
     if (/\$[A-Za-z_]|[{}\[\]]|process\.env|getenv|os\.environ|config\s*\(|env\s*\(/.test(valueRaw))
       continue;
+    if (/^FLAG\{[a-z0-9_\-]+\}$/i.test(value) || /^FLAG$/i.test(value))
+      continue;
+    if (qm && /^["'][^"']+["']\s*\+/.test(valueRaw))
+      continue;
     const ln = lineNo2(code, m.index);
     flaggedLines.add(ln);
     let sev = "high";
@@ -16795,6 +16866,48 @@ function detectRustFormatString(code, file, out) {
     });
   }
 }
+function detectJwtAlgConfusion(code, file, out) {
+  const clean = stripCommentsOnly(code);
+  const hasRs256 = /\bRS256\b/.test(clean);
+  const hasHs256 = /\bHS256\b/.test(clean);
+  if (!hasRs256 || !hasHs256)
+    return;
+  const hmacPublicKey = /createHmac\s*\(\s*['"]sha256['"]\s*,\s*(?:[A-Za-z_][\w.]*\.(?:publicKey|public_key|PUBLIC_KEY|verifying_key|verifyingKey)|publicKey|public_key|PUBLIC_KEY)/.test(clean) || /algorithms\s*=\s*\[[^\]]*['"]HS256['"]\s*,\s*['"]RS256['"]/.test(clean) || /algorithms\s*=\s*\[[^\]]*['"]RS256['"]\s*,\s*['"]HS256['"]/.test(clean);
+  if (!hmacPublicKey)
+    return;
+  const ls = lines2(code);
+  const ln = lineNo2(code, clean.search(/\bHS256\b/));
+  out.push({
+    file,
+    line: ln,
+    type: "jwt_alg_confusion",
+    category: "JWT algorithm confusion (RS256 -> HS256)",
+    severity: "critical",
+    evidence: (ls[ln - 1] ?? "").trim(),
+    detail: "The JWT verifier dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material. An attacker sets alg=HS256 and signs with the public key to forge a valid token (CVE-2015-9235 family). Pin the algorithm server-side (allow only RS256) and never reuse asymmetric public keys as symmetric HMAC secrets."
+  });
+}
+function detectCacheDeception(code, file, out) {
+  const clean = stripCommentsOnly(code);
+  const staticCache = /proxy_cache\b|proxy_cache_path\b|proxy_cache_key\b/.test(clean);
+  if (!staticCache)
+    return;
+  const cacheKeyNoCookie = /proxy_cache_key\s+[^;]*\$scheme[^;]*\$request_uri[^;]*;/.test(clean) && !/proxy_cache_key\s+[^;]*\$cookie/.test(clean);
+  const staticExt = /location\s+~?\*?\s+\\?\.[a-z|()]*(css|js|png|jpg|jpeg|gif|ico|woff|svg|map)/.test(clean) || /location\s+~[*\s]*\\\./.test(clean);
+  if (!cacheKeyNoCookie || !staticExt)
+    return;
+  const ls = lines2(code);
+  const ln = lineNo2(code, clean.search(/proxy_cache_key\b/));
+  out.push({
+    file,
+    line: ln,
+    type: "cache_deception",
+    category: "Web cache deception (cookie-less static cache key)",
+    severity: "high",
+    evidence: (ls[ln - 1] ?? "").trim(),
+    detail: "The reverse proxy caches static-extension URLs using a cache key that excludes the session cookie, while a backend route (often a greedy regex like /account(/.*)?) returns per-session private data for such URLs. An attacker can poison the cache with a victim's session response and re-fetch it anonymously. Include the cookie in the cache key, or don't cache cookie-authenticated responses."
+  });
+}
 var SOURCE_TOKENS3, MAGIC_METHODS, SECRET_FIELD_RE, SECRET_PLACEHOLDER_RE, ENTROPY_EXCLUDE_VAR;
 var init_complex_bugs = __esm(() => {
   init_security_state();
@@ -17002,8 +17115,29 @@ $r = openai.chat.completions.create(['messages' => [['role' => 'user', 'content'
       id: "rust-format-string",
       detector: "rust_format_string",
       file: "main.rs",
-      positive: `fn f() { println!(user_input); }\\n`,
-      negative: `fn f() { println!("{}", user_input); }\\n`
+      positive: `fn f() { println!(user_input); }
+`,
+      negative: `fn f() { println!("{}", user_input); }
+`
+    },
+    {
+      id: "jwt-alg-confusion",
+      detector: "jwt_alg_confusion",
+      file: "auth.js",
+      positive: `function verify(t){ if(t.alg==='RS256'){ verifier.verify(KEYS.publicKey); } else if(t.alg==='HS256'){ crypto.createHmac('sha256', KEYS.publicKey).update(d).digest(); } }
+`,
+      negative: `function verify(t){ if(t.alg==='RS256'){ verifier.verify(KEYS.publicKey); } else { throw new Error('unsupported alg'); } }
+`
+    },
+    {
+      id: "cache-deception",
+      detector: "cache_deception",
+      file: "nginx.conf",
+      positive: `location ~* \\.(css|js|png|jpg|gif|ico|svg)$ { proxy_cache ctf_cache; proxy_cache_valid 200 5m; }
+proxy_cache_key "$scheme$request_method$request_uri";
+`,
+      negative: `location / { proxy_pass http://backend; }
+`
     }
   ];
 });
@@ -58313,7 +58447,15 @@ var ALIASES = {
   transmute: "rust_unsafe",
   "rust format string": "rust_format_string",
   "format string": "rust_format_string",
-  "format string injection": "rust_format_string"
+  "format string injection": "rust_format_string",
+  "jwt algorithm confusion": "jwt_alg_confusion",
+  "jwt alg confusion": "jwt_alg_confusion",
+  "alg confusion": "jwt_alg_confusion",
+  "rs256 hs256": "jwt_alg_confusion",
+  "web cache deception": "cache_deception",
+  "cache deception": "cache_deception",
+  "cache poisoning": "cache_deception",
+  "cache key injection": "cache_deception"
 };
 function normalize(term) {
   return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
@@ -58703,7 +58845,9 @@ var VRT_MAP = {
   dependency_confusion: { vrt: "insecure_design > dependency_confusion", priority: "P2", severity: "high", rationale: "An internal package resolves from a squattable public registry → attacker-controlled code in the build." },
   ml_supply_chain: { vrt: "injection > insecure_deserialization", priority: "P1", severity: "critical", rationale: "Untrusted model loading via pickle (torch/joblib/numpy) → arbitrary code execution on load." },
   rust_unsafe: { vrt: "insecure_design > unsafe_memory_operations", priority: "P3", severity: "medium", rationale: "transmute/from_raw_parts/assume_init bypass the borrow checker — a hint that needs bounds verification; memory corruption if attacker-controlled." },
-  rust_format_string: { vrt: "injection > format_string_injection", priority: "P2", severity: "high", rationale: "An attacker-controlled format string can read or corrupt memory via format specifiers." }
+  rust_format_string: { vrt: "injection > format_string_injection", priority: "P2", severity: "high", rationale: "An attacker-controlled format string can read or corrupt memory via format specifiers." },
+  jwt_alg_confusion: { vrt: "authentication > jwt_algorithm_confusion", priority: "P1", severity: "critical", rationale: "A verifier accepting HS256 with public-key HMAC lets an attacker forge admin tokens (CVE-2015-9235)." },
+  cache_deception: { vrt: "cryptographic_failure > web_cache_deception", priority: "P2", severity: "high", rationale: "Cookie-less static cache keys leak per-session private responses to anonymous callers." }
 };
 function severityCalibrate(input) {
   const type = input.type?.toLowerCase() ?? "";

package/intelligence/cwe_map.json

@@ -330,6 +330,18 @@
       "id": "rust_format_string",
       "cwe": "CWE-134",
       "name": "Use of Externally-Controlled Format String"
+    },
+    {
+      "id": "jwt_alg_confusion",
+      "cwe": "CWE-347",
+      "name": "Improper Verification of Cryptographic Signature",
+      "category": "authentication"
+    },
+    {
+      "id": "cache_deception",
+      "cwe": "CWE-525",
+      "name": "Use of Web Browser Cache Containing Sensitive Information",
+      "category": "cryptographic_failure"
     }
   ]
 }

package/intelligence/patterns.json

@@ -691,6 +691,74 @@
         "any panic path that formats attacker input",
         "logging/telemetry that echoes request data"
       ]
+    },
+    {
+      "id": "jwt_alg_confusion",
+      "name": "JWT Algorithm Confusion (RS256 -> HS256)",
+      "cwe": "CWE-347",
+      "severity": "critical",
+      "signature": "alg-dispatch verifier accepting RS256 AND HS256 with public/shared HMAC key",
+      "chains": [
+        "jwt"
+      ],
+      "references": [
+        "CVE-2015-9235",
+        "OWASP ASVS V3.5.2"
+      ],
+      "real_world": "A hand-written JWT verifier dispatches on the token's alg header and accepts BOTH RS256 (asymmetric) and HS256 (symmetric HMAC), with the HS256 secret derived from the RSA public key. Setting alg=HS256 and signing with the public key forges a valid token.",
+      "detection_signatures": [
+        "alg-dispatch verifier accepting RS256 AND HS256",
+        "createHmac('sha256', <publicKey>) alongside createVerify('RSA-SHA256')",
+        "pyjwt decode(..., algorithms=['HS256','RS256'])"
+      ],
+      "chain_templates": [
+        "jwt_alg_confusion_forgery",
+        "jwt_algorithm_confusion"
+      ],
+      "bypass_techniques": [
+        "public-key-to-HMAC confusion",
+        "kid/jku header injection to point the verifier at attacker keys",
+        "alg:none / empty signature when the verifier also accepts it"
+      ],
+      "crown_jewels": [
+        "the RSA public key (published at /.well-known/jwks.json)",
+        "admin role claims overridden by token claims",
+        "treasury/admin endpoints gated only by a role claim"
+      ]
+    },
+    {
+      "id": "cache_deception",
+      "name": "Web Cache Deception",
+      "cwe": "CWE-525",
+      "severity": "high",
+      "signature": "reverse-proxy caches static-extension URLs with a cookie-less cache key over a session-authenticated backend",
+      "chains": [
+        "cache_deception"
+      ],
+      "references": [
+        "CWE-525",
+        "Omer Gil — Web Cache Deception Attack",
+        "OWASP WSTG-ATHN-03"
+      ],
+      "real_world": "A reverse proxy caches static-extension URLs (.css/.js/.png) with a cache key that omits the session cookie, while a backend route (often a greedy regex like /account(/.*)?) serves per-session private data for those URLs. An attacker submits a victim-visited URL, the bot's private response is cached, then re-fetched anonymously.",
+      "detection_signatures": [
+        "proxy_cache_key without $cookie over a session-authenticated backend",
+        "location ~* \\.(css|js|png|...) with proxy_cache",
+        "greedy backend route regex + static-extension passthrough"
+      ],
+      "chain_templates": [
+        "cache_poisoning_xss"
+      ],
+      "bypass_techniques": [
+        "append a static extension to an authenticated path",
+        "path delimiters (; / ..) that still match the route regex",
+        "cache-key normalization differences (trailing slash, percent-encoding)"
+      ],
+      "crown_jewels": [
+        "per-session private profile/account JSON",
+        "api_key / session tokens in the cached body",
+        "any victim-session data cached under a static-extension URL"
+      ]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.74",
+  "version": "2.4.76",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {