blitzstrike 2.4.75 → 2.4.77

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.77] — 2026-09-17
+
+### Changed — SQLi Node/Python coverage + missing_authz root-path precision
+
+- `detectSqlInjection` now matches Node/Python sinks (`pool.query`, `client.query`,
+  `connection.query`, `db.query`, `pg.query`, `sequelize.query`, `knex.raw`,
+  `sqlx::query(&format!`, `cursor.execute` / `.execute`) and recognizes Node
+  template-literal `${var}`, Python f-string `{var}`, and JS `+ var` interpolation
+  as string-built queries (cross-file case).
+- `detectRouteAuthz` now skips root/empty paths (`@app.get("/")`) as public-by-design
+  (was flagging the index route), plus `home`/`index`/`root` route segments.
+
+## [2.4.76] — 2026-09-17
+
+### Fixed — config/manifest files were not scanned (whole-class FN)
+
+- `iterSourceFiles` only walked code extensions (php/py/js/ts/...), so the
+  detectors never saw nginx configs, manifests, or other-language sources.
+  Added `.conf/.config/.nginx`, `.json/.yaml/.yml/.toml/.xml/.properties/.gradle/.proto`,
+  `.env/.txt`, and `.rb/.go/.rs/.cs/.c/.h/.cpp/.cc/.hpp/.sh/.bash`. This unblocks
+  `cache_deception` (nginx.conf — caught labs01) and `dependency_confusion` /
+  `oauth_misconfig` / `grpc_reflection` (package.json / requirements.txt / yaml).
+
 ## [2.4.75] — 2026-09-17
 
 ### Fixed — detection FP/FN remediation (Hackbot Arena benchmark-driven)

package/dist/index.js

@@ -7280,7 +7280,31 @@ var init_scanner = __esm(() => {
     ".mjs",
     ".cjs",
     ".ts",
-    ".tsx"
+    ".tsx",
+    ".rb",
+    ".go",
+    ".rs",
+    ".cs",
+    ".c",
+    ".h",
+    ".cpp",
+    ".cc",
+    ".hpp",
+    ".sh",
+    ".bash",
+    ".conf",
+    ".config",
+    ".nginx",
+    ".json",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".xml",
+    ".properties",
+    ".gradle",
+    ".proto",
+    ".env",
+    ".txt"
   ]);
   SKIP_PARTS = new Set(["vendor", "node_modules", ".git", "tests", "test"]);
   LIB_PARTS = new Set([
@@ -16074,7 +16098,7 @@ var init_framework_security = __esm(() => {
     { framework: "aspnet", entry: /\[Http(?:Get|Post|Put|Delete|Patch)\b/g, auth: /\[Authorize|User\.Identity|IsInRole|AuthorizeAsync|\[AllowAnonymous|IAuthorizationService/, window: 2 },
     { framework: "rails", entry: /class\s+\w+\s*<\s*ApplicationController/g, auth: /before_action\s+:authenticate|before_action\s+:authorize|authenticate_user!|authorize\s+|current_user|authenticate/, window: 6 }
   ];
-  PUBLIC_ROUTE_RE = /['"`]\/?(?:(?:api|v1|v2|o|auth|adminapi)\/)?(?:register|login|logout|signup|signin|forgot-password|reset-password|health|healthz|ready|status|version|ping|static|public|assets|css|js|img|favicon|echo|config|docs|openapi|swagger|robots|sitemap|graphql|graphiql|query|upload|callback|webhook)[/'"?]|['"`]\/?['"`]$/i;
+  PUBLIC_ROUTE_RE = /['"`]\/?(?:(?:api|v1|v2|o|auth|adminapi)\/)?(?:register|login|logout|signup|signin|forgot-password|reset-password|health|healthz|ready|status|version|ping|static|public|assets|css|js|img|favicon|echo|config|docs|openapi|swagger|robots|sitemap|graphql|graphiql|query|upload|callback|webhook|home|index|root)[/'"?]|['"`]\/?['"`](?!["'`])/i;
 });
 
 // src/complex-bugs.ts
@@ -16519,7 +16543,7 @@ function detectUnrestrictedUpload(code, file, out) {
 }
 function detectSqlInjection(code, file, out) {
   const ls = lines2(code);
-  const sinkRe = /\$wpdb->(get_results|get_col|get_var|get_row|query)\s*\(|->query\s*\(|->execute\s*\(|mysqli_query\s*\(|pg_query\s*\(|DB::unprepared\s*\(|[->.]whereRaw\s*\(|[->.]selectRaw\s*\(/g;
+  const sinkRe = /\$wpdb->(get_results|get_col|get_var|get_row|query)\s*\(|[->.]query\s*\(|[->.]execute\s*\(|mysqli_query\s*\(|pg_query\s*\(|DB::unprepared\s*\(|[->.]whereRaw\s*\(|[->.]selectRaw\s*\(|sqlx::query(?:_as)?\s*\(\s*&\s*format!|sequelize\.query\s*\(|knex\.raw\s*\(|\bpool\.query\s*\(|\bclient\.query\s*\(|\bconnection\.query\s*\(|\bdb\.query\s*\(|\bpg\.query\s*\(/g;
   let m;
   while ((m = sinkRe.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16530,8 +16554,8 @@ function detectSqlInjection(code, file, out) {
       continue;
     if (SOURCE_TOKENS3.test(scope))
       continue;
-    const inlineConcat = /(\.\s*\$[A-Za-z_]\w*|\+\s*[A-Za-z_$]\w*)/.test(l);
-    const assignConcat = /(?:^|\n)\s*\$[A-Za-z_]\w*\s*(?:\.=|=)\s*[^;\n]*["'][^"']*["']\s*\.\s*\$[A-Za-z_]\w*/.test(scope);
+    const inlineConcat = /(\.\s*\$[A-Za-z_]\w*|\+\s*[A-Za-z_$]\w*|\$\{[^}]+\}|<<\s*[A-Za-z_$]|\{[A-Za-z_]\w*\})/.test(l);
+    const assignConcat = /(?:^|\n)\s*\$[A-Za-z_]\w*\s*(?:\.=|=)\s*[^;\n]*["'][^"']*["']\s*\.\s*\$[A-Za-z_]\w*/.test(scope) || /(?:^|\n)\s*(?:const|let|var)\s+[A-Za-z_$]\w*\s*=\s*`[^`]*\$\{[^}]+\}[^`]*`/.test(scope) || /(?:^|\n)\s*[A-Za-z_]\w*\s*=\s*f["']/.test(scope);
     if (!inlineConcat && !assignConcat)
       continue;
     out.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.75",
+  "version": "2.4.77",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {