blitzstrike 2.4.77 → 2.4.79

package/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.79] — 2026-09-17
+
+### Changed — precision pass (FP reduction, benchmark-driven)
+
+- Removed the bare `exec(` sink (sqlite `db.exec(...)` / `stmt.exec(...)` was
+  flagged as command execution in Node apps). Command injection is still covered
+  by `child_process.exec/spawn`, `system`, `shell_exec`, `subprocess.*`,
+  `os.system`, `popen`.
+- `detectRouteAuthz`: added `requireAdmin`/`requireRole`/`requirePermission`/
+  `isAdmin`/`checkRole`/`bearer`/`apiAuth`/`getApiKeyFromRequest`/`verifyApiKey`
+  to the express auth model + widened the window to ±3, and added a public-path
+  SEGMENT matcher for multi-segment public routes (`/api/system/version`,
+  `/.well-known/jwks.json`, `/v1/metrics`).
+- `detectHardcodedSecret`: skip values that are function calls
+  (`getApiKeyFromRequest(req)`, `fs.readFileSync(...)`, `make_token(...)`) or DOM
+  reads (`document.getElementById(...).value`) — those are computed at runtime.
+
+FP labs on the 30-lab benchmark dropped 16 → 8 (TP 12 unchanged).
+
+## [2.4.78] — 2026-09-17
+
+### Fixed — taint-engine sanitizer name collision (whole-class FN)
+
+- The Python taint adapter neutralized every identifier inside a sanitizer call
+  (e.g. `int(os.environ.get("PORT", "5000"))` neutralized the method name `get`
+  for sql_execution/command_execution). Because taint state is keyed by name, that
+  polluted the `get` in `request.args.get(...)` elsewhere and wrongly suppressed
+  real findings (labs20 f-string SQLi went undetected). Sanitizers now only
+  neutralize VALUE arguments, skipping dotted-chain receiver/method names and
+  string literals. Python f-string SQLi (`request.args.get -> f"{var}" -> execute`)
+  is now caught.
+
 ## [2.4.77] — 2026-09-17
 
 ### Changed — SQLi Node/Python coverage + missing_authz root-path precision

package/dist/index.js

@@ -7190,7 +7190,6 @@ var init_scanner = __esm(() => {
     "eval(": "RCE (code execution)",
     "assert(": "RCE (code execution, PHP <8)",
     "system(": "RCE (command execution)",
-    "exec(": "RCE (command execution)",
     "shell_exec(": "RCE (command execution)",
     "passthru(": "RCE (command execution)",
     "proc_open(": "RCE (command execution)",
@@ -15981,7 +15980,7 @@ function detectRouteAuthz(code, file, out) {
       const ln = lineNoOf(code, m.index);
       const window2 = ls.slice(Math.max(0, ln - d.window), Math.min(ls.length, ln + d.window + 1)).join(`
 `);
-      if (PUBLIC_ROUTE_RE.test(m[0] + " " + window2))
+      if (PUBLIC_ROUTE_RE.test(m[0] + " " + window2) || PUBLIC_SEGMENT_RE.test(m[0] + " " + window2))
         continue;
       if (d.auth.test(window2))
         continue;
@@ -16010,7 +16009,7 @@ function detectMissingAuthz(code, file) {
     return true;
   });
 }
-var FRAMEWORKS, INDIRECT_AUTH, AUTH_RE, NONCE_RE, DANGEROUS_OP_RE, ROUTE_DETECTORS, PUBLIC_ROUTE_RE;
+var FRAMEWORKS, INDIRECT_AUTH, AUTH_RE, NONCE_RE, DANGEROUS_OP_RE, ROUTE_DETECTORS, PUBLIC_ROUTE_RE, PUBLIC_SEGMENT_RE;
 var init_framework_security = __esm(() => {
   FRAMEWORKS = {
     wordpress: {
@@ -16092,13 +16091,14 @@ var init_framework_security = __esm(() => {
     { framework: "laravel", entry: /Route::(?:get|post|put|patch|delete|any|match|resource)\s*\(\s*['"][^'"]+['"]/g, auth: /->middleware\s*\(\s*['"]auth|middleware\s*\(\s*\[[^\]]*['"]auth|->can\s*\(|\$this->authorize|Gate::|authorize\s*\(|@can\b/, window: 2 },
     { framework: "django", entry: /@api_view\s*\(|def\s+\w+\s*\(\s*request\s*[,)]/g, auth: /login_required|permission_required|user_passes_test|LoginRequiredMixin|PermissionRequiredMixin|permission_classes|IsAuthenticated|has_permission/, window: 3 },
     { framework: "flask", entry: /@(?:app|bp|blueprint)\.(?:route|get|post|put|delete|patch|before_request)\s*\(/g, auth: /login_required|require_auth|auth_required|jwt_required|token_required|current_user|is_authenticated|before_request|verify_token|permission_required/, window: 3 },
-    { framework: "express", entry: /(?<!@)(?:app|router)\.(?:get|post|put|delete|patch|use)\s*\(\s*['"][^'"]+['"]/g, auth: /requireAuth|require_auth|authenticate|passport\.authenticate|req\.user|isAuthenticated|ensureAuthenticated|requireLogin|\.authorize|authMiddleware|verifyToken|verify_token|jwt\.verify/, window: 2 },
+    { framework: "express", entry: /(?<!@)(?:app|router)\.(?:get|post|put|delete|patch|use)\s*\(\s*['"][^'"]+['"]/g, auth: /requireAuth|require_auth|requireAdmin|requireRole|requirePermission|isAdmin|checkRole|getApiKeyFromRequest|verifyApiKey|checkApiKey|verifyInternalToken|authenticate|passport\.authenticate|req\.user|isAuthenticated|ensureAuthenticated|requireLogin|\.authorize|authMiddleware|verifyToken|verify_token|jwt\.verify|\bbearer\b|apiAuth/, window: 3 },
     { framework: "spring", entry: /@(?:Get|Post|Put|Delete|Patch|Request)Mapping\s*\(/g, auth: /@PreAuthorize|@Secured|@RolesAllowed|hasRole|hasAuthority|isAuthenticated|SecurityContextHolder/, window: 2 },
     { framework: "symfony", entry: /#\[(?:Route|Get|Post|Put|Delete|Patch)\b|@Route\s*\(/g, auth: /is_granted|denyAccessUnlessGranted|->isGranted\s*\(|IsGranted|Voter/, window: 2 },
     { framework: "aspnet", entry: /\[Http(?:Get|Post|Put|Delete|Patch)\b/g, auth: /\[Authorize|User\.Identity|IsInRole|AuthorizeAsync|\[AllowAnonymous|IAuthorizationService/, window: 2 },
     { framework: "rails", entry: /class\s+\w+\s*<\s*ApplicationController/g, auth: /before_action\s+:authenticate|before_action\s+:authorize|authenticate_user!|authorize\s+|current_user|authenticate/, window: 6 }
   ];
-  PUBLIC_ROUTE_RE = /['"`]\/?(?:(?:api|v1|v2|o|auth|adminapi)\/)?(?:register|login|logout|signup|signin|forgot-password|reset-password|health|healthz|ready|status|version|ping|static|public|assets|css|js|img|favicon|echo|config|docs|openapi|swagger|robots|sitemap|graphql|graphiql|query|upload|callback|webhook|home|index|root)[/'"?]|['"`]\/?['"`](?!["'`])/i;
+  PUBLIC_ROUTE_RE = /['"`]\/?(?:(?:api|v1|v2|o|auth|adminapi|system|internal)\/)?(?:register|login|logout|signup|signin|forgot-password|reset-password|health|healthz|ready|status|version|ping|static|public|assets|css|js|img|favicon|echo|config|docs|openapi|swagger|robots|sitemap|graphql|graphiql|query|upload|callback|webhook|home|index|root|jwks|well-known|openid-configuration|traces|logs|metrics)[/'"?]|['"`]\/?['"`](?!["'`])/i;
+  PUBLIC_SEGMENT_RE = /['"`][^'"`]*\/(?:version|health|healthz|ready|status|ping|jwks|openid-configuration|well-known|metrics|traces|logs|favicon|robots|sitemap)(?:[.\/'"?]|$)/i;
 });
 
 // src/complex-bugs.ts
@@ -16596,6 +16596,10 @@ function detectHardcodedSecret(code, file, out) {
       continue;
     if (qm && /^["'][^"']+["']\s*\+/.test(valueRaw))
       continue;
+    if (!qm && new RegExp(`${value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\(`).test(valueRaw))
+      continue;
+    if (!qm && /document\.|window\.|localStorage\.|sessionStorage\./.test(valueRaw))
+      continue;
     const ln = lineNo2(code, m.index);
     flaggedLines.add(ln);
     let sev = "high";
@@ -56908,9 +56912,13 @@ var pythonAdapter = {
             sinks.push({ variable: v, kind, line: lineOf(n), cwe });
         }
         for (const [re, kinds] of PY_SANITIZERS) {
-          if (re.test(full))
-            for (const v of argVars)
+          if (re.test(full)) {
+            for (const v of argVars) {
+              if (new RegExp(`\\b${v}\\s*[.(]`).test(full))
+                continue;
               sanitizers.push({ variable: v, neutralizes: kinds, line: lineOf(n) });
+            }
+          }
         }
         calls.push({ name: callee, args: argVars, line: lineOf(n) });
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.77",
+  "version": "2.4.79",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {