blitzstrike 2.4.77 → 2.4.78

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.78] — 2026-09-17
+
+### Fixed — taint-engine sanitizer name collision (whole-class FN)
+
+- The Python taint adapter neutralized every identifier inside a sanitizer call
+  (e.g. `int(os.environ.get("PORT", "5000"))` neutralized the method name `get`
+  for sql_execution/command_execution). Because taint state is keyed by name, that
+  polluted the `get` in `request.args.get(...)` elsewhere and wrongly suppressed
+  real findings (labs20 f-string SQLi went undetected). Sanitizers now only
+  neutralize VALUE arguments, skipping dotted-chain receiver/method names and
+  string literals. Python f-string SQLi (`request.args.get -> f"{var}" -> execute`)
+  is now caught.
+
 ## [2.4.77] — 2026-09-17
 
 ### Changed — SQLi Node/Python coverage + missing_authz root-path precision

package/dist/index.js

@@ -56908,9 +56908,13 @@ var pythonAdapter = {
             sinks.push({ variable: v, kind, line: lineOf(n), cwe });
         }
         for (const [re, kinds] of PY_SANITIZERS) {
-          if (re.test(full))
-            for (const v of argVars)
+          if (re.test(full)) {
+            for (const v of argVars) {
+              if (new RegExp(`\\b${v}\\s*[.(]`).test(full))
+                continue;
               sanitizers.push({ variable: v, neutralizes: kinds, line: lineOf(n) });
+            }
+          }
         }
         calls.push({ name: callee, args: argVars, line: lineOf(n) });
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.77",
+  "version": "2.4.78",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {