blitzstrike 2.4.76 → 2.4.78

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.78] — 2026-09-17
+
+### Fixed — taint-engine sanitizer name collision (whole-class FN)
+
+- The Python taint adapter neutralized every identifier inside a sanitizer call
+  (e.g. `int(os.environ.get("PORT", "5000"))` neutralized the method name `get`
+  for sql_execution/command_execution). Because taint state is keyed by name, that
+  polluted the `get` in `request.args.get(...)` elsewhere and wrongly suppressed
+  real findings (labs20 f-string SQLi went undetected). Sanitizers now only
+  neutralize VALUE arguments, skipping dotted-chain receiver/method names and
+  string literals. Python f-string SQLi (`request.args.get -> f"{var}" -> execute`)
+  is now caught.
+
+## [2.4.77] — 2026-09-17
+
+### Changed — SQLi Node/Python coverage + missing_authz root-path precision
+
+- `detectSqlInjection` now matches Node/Python sinks (`pool.query`, `client.query`,
+  `connection.query`, `db.query`, `pg.query`, `sequelize.query`, `knex.raw`,
+  `sqlx::query(&format!`, `cursor.execute` / `.execute`) and recognizes Node
+  template-literal `${var}`, Python f-string `{var}`, and JS `+ var` interpolation
+  as string-built queries (cross-file case).
+- `detectRouteAuthz` now skips root/empty paths (`@app.get("/")`) as public-by-design
+  (was flagging the index route), plus `home`/`index`/`root` route segments.
+
 ## [2.4.76] — 2026-09-17
 
 ### Fixed — config/manifest files were not scanned (whole-class FN)

package/dist/index.js

@@ -16098,7 +16098,7 @@ var init_framework_security = __esm(() => {
     { framework: "aspnet", entry: /\[Http(?:Get|Post|Put|Delete|Patch)\b/g, auth: /\[Authorize|User\.Identity|IsInRole|AuthorizeAsync|\[AllowAnonymous|IAuthorizationService/, window: 2 },
     { framework: "rails", entry: /class\s+\w+\s*<\s*ApplicationController/g, auth: /before_action\s+:authenticate|before_action\s+:authorize|authenticate_user!|authorize\s+|current_user|authenticate/, window: 6 }
   ];
-  PUBLIC_ROUTE_RE = /['"`]\/?(?:(?:api|v1|v2|o|auth|adminapi)\/)?(?:register|login|logout|signup|signin|forgot-password|reset-password|health|healthz|ready|status|version|ping|static|public|assets|css|js|img|favicon|echo|config|docs|openapi|swagger|robots|sitemap|graphql|graphiql|query|upload|callback|webhook)[/'"?]|['"`]\/?['"`]$/i;
+  PUBLIC_ROUTE_RE = /['"`]\/?(?:(?:api|v1|v2|o|auth|adminapi)\/)?(?:register|login|logout|signup|signin|forgot-password|reset-password|health|healthz|ready|status|version|ping|static|public|assets|css|js|img|favicon|echo|config|docs|openapi|swagger|robots|sitemap|graphql|graphiql|query|upload|callback|webhook|home|index|root)[/'"?]|['"`]\/?['"`](?!["'`])/i;
 });
 
 // src/complex-bugs.ts
@@ -16543,7 +16543,7 @@ function detectUnrestrictedUpload(code, file, out) {
 }
 function detectSqlInjection(code, file, out) {
   const ls = lines2(code);
-  const sinkRe = /\$wpdb->(get_results|get_col|get_var|get_row|query)\s*\(|->query\s*\(|->execute\s*\(|mysqli_query\s*\(|pg_query\s*\(|DB::unprepared\s*\(|[->.]whereRaw\s*\(|[->.]selectRaw\s*\(/g;
+  const sinkRe = /\$wpdb->(get_results|get_col|get_var|get_row|query)\s*\(|[->.]query\s*\(|[->.]execute\s*\(|mysqli_query\s*\(|pg_query\s*\(|DB::unprepared\s*\(|[->.]whereRaw\s*\(|[->.]selectRaw\s*\(|sqlx::query(?:_as)?\s*\(\s*&\s*format!|sequelize\.query\s*\(|knex\.raw\s*\(|\bpool\.query\s*\(|\bclient\.query\s*\(|\bconnection\.query\s*\(|\bdb\.query\s*\(|\bpg\.query\s*\(/g;
   let m;
   while ((m = sinkRe.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16554,8 +16554,8 @@ function detectSqlInjection(code, file, out) {
       continue;
     if (SOURCE_TOKENS3.test(scope))
       continue;
-    const inlineConcat = /(\.\s*\$[A-Za-z_]\w*|\+\s*[A-Za-z_$]\w*)/.test(l);
-    const assignConcat = /(?:^|\n)\s*\$[A-Za-z_]\w*\s*(?:\.=|=)\s*[^;\n]*["'][^"']*["']\s*\.\s*\$[A-Za-z_]\w*/.test(scope);
+    const inlineConcat = /(\.\s*\$[A-Za-z_]\w*|\+\s*[A-Za-z_$]\w*|\$\{[^}]+\}|<<\s*[A-Za-z_$]|\{[A-Za-z_]\w*\})/.test(l);
+    const assignConcat = /(?:^|\n)\s*\$[A-Za-z_]\w*\s*(?:\.=|=)\s*[^;\n]*["'][^"']*["']\s*\.\s*\$[A-Za-z_]\w*/.test(scope) || /(?:^|\n)\s*(?:const|let|var)\s+[A-Za-z_$]\w*\s*=\s*`[^`]*\$\{[^}]+\}[^`]*`/.test(scope) || /(?:^|\n)\s*[A-Za-z_]\w*\s*=\s*f["']/.test(scope);
     if (!inlineConcat && !assignConcat)
       continue;
     out.push({
@@ -56908,9 +56908,13 @@ var pythonAdapter = {
             sinks.push({ variable: v, kind, line: lineOf(n), cwe });
         }
         for (const [re, kinds] of PY_SANITIZERS) {
-          if (re.test(full))
-            for (const v of argVars)
+          if (re.test(full)) {
+            for (const v of argVars) {
+              if (new RegExp(`\\b${v}\\s*[.(]`).test(full))
+                continue;
               sanitizers.push({ variable: v, neutralizes: kinds, line: lineOf(n) });
+            }
+          }
         }
         calls.push({ name: callee, args: argVars, line: lineOf(n) });
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.76",
+  "version": "2.4.78",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {