blitzstrike 2.4.86 → 2.4.88

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.88] — 2026-09-17
+
+### Changed — XSS detector precision (local taint flow)
+
+- `xss` no longer flags a DOM sink merely because a source exists somewhere in the
+  same file. It now builds a tainted-variable set via assignment flow (transitive,
+  ≤3 hops) and flags a sink only when its argument references a tainted variable or
+  is a direct source expression. Removes the "source + sink co-occurrence" false
+  positives (4 FPs on the 30-lab benchmark) with zero recall loss.
+
+## [2.4.87] — 2026-09-17
+
+### Fixed — web3 class naming consistency + jwt grounding
+
+- Renamed the web3 class `encodePacked_collision` → `encode_packed_collision`
+  (snake_case, matching the other classes; fixes resolution through canonical id).
+- Added the `jwt` → `jwt_alg_confusion` synonym so the `jwt` attack-vector resolves
+  to its pattern grounding + payout (previously returned no bounty signal).
+
 ## [2.4.86] — 2026-09-17
 
 ### Added — Web3 audit extended to 13 bug classes

package/dist/index.js

@@ -16937,11 +16937,34 @@ function detectCorsMisconfig(code, file, out) {
 function detectXss(code, file, out) {
   const clean = stripCommentsOnly(code);
   const ls = lines2(code);
-  const hasSource = /\b(?:req\.(?:query|params|body|cookies|headers)|request\.(?:get|args|form|json|values|headers|params)|location\.(?:hash|search|href)|window\.location|document\.(?:URL|referrer)|URLSearchParams|searchParams\.get|getElementById\([^)]*\)\.value|routeParams|queryParams|this\.props|params\s*[:=])/i.test(clean) || /\b(?:req\.(?:query|params|body)|request\.(?:get|args|json|values)|location\.(?:hash|search))\b/i.test(clean);
-  if (!hasSource)
+  const isSourceExpr = (expr) => /\b(?:req\.(?:query|params|body|cookies|headers)|request\.(?:get|args|form|json|values|headers|params)|location\.(?:hash|search|href)|window\.location|document\.(?:URL|referrer)|URLSearchParams|searchParams\.get|getElementById\([^)]*\)\.value|routeParams|queryParams|this\.props)\b/i.test(expr);
+  const tainted = new Set;
+  const assignments = [];
+  const assignRe = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)|(?<![\w$.])([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+  let m;
+  while ((m = assignRe.exec(clean)) !== null) {
+    const lhs = m[1] ?? m[3];
+    const rhs = (m[2] ?? m[4] ?? "").trim();
+    if (lhs)
+      assignments.push({ lhs, rhs });
+  }
+  for (let hop = 0;hop < 3; hop++) {
+    let changed = false;
+    for (const a of assignments) {
+      if (tainted.has(a.lhs))
+        continue;
+      const refsTainted = [...tainted].some((t) => new RegExp(`\\b${t}\\b`).test(a.rhs));
+      if (isSourceExpr(a.rhs) || refsTainted) {
+        tainted.add(a.lhs);
+        changed = true;
+      }
+    }
+    if (!changed)
+      break;
+  }
+  if (tainted.size === 0)
     return;
   const sinkRe = /dangerouslySetInnerHTML|\.innerHTML\s*=|\.outerHTML\s*=|document\.write\s*\(|insertAdjacentHTML\s*\(|\.html\s*\(|eval\s*\(/g;
-  let m;
   const seen = new Set;
   while ((m = sinkRe.exec(clean)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16951,9 +16974,8 @@ function detectXss(code, file, out) {
     const rest = line.slice(line.indexOf(m[0]) + m[0].length);
     if (/^\s*["'`]/.test(rest))
       continue;
-    if (m[0] === "eval(" && /^\s*["'`]/.test(rest))
-      continue;
-    if (m[0] === "dangerouslySetInnerHTML" && !/__html\s*:\s*[^'"`]/.test(line))
+    const refsTainted = [...tainted].some((t) => new RegExp(`\\b${t}\\b`).test(rest));
+    if (!refsTainted && !isSourceExpr(rest))
       continue;
     seen.add(ln);
     out.push({
@@ -34491,6 +34513,7 @@ var ALIASES = {
   "rust format string": "rust_format_string",
   "format string": "rust_format_string",
   "format string injection": "rust_format_string",
+  jwt: "jwt_alg_confusion",
   "jwt algorithm confusion": "jwt_alg_confusion",
   "jwt alg confusion": "jwt_alg_confusion",
   "alg confusion": "jwt_alg_confusion",
@@ -60489,7 +60512,7 @@ var SEVERITY = {
   timestamp_dependence: { severity: "medium", cwe: "CWE-1164", category: "block.timestamp / block.number dependence" },
   oracle_manipulation: { severity: "high", cwe: "CWE-1235", category: "Spot-price oracle (DEX pair) manipulation" },
   unbounded_loop: { severity: "medium", cwe: "CWE-834", category: "Unbounded loop over user-controlled length" },
-  encodePacked_collision: { severity: "high", cwe: "CWE-701", category: "abi.encodePacked hash collision (dynamic types)" },
+  encode_packed_collision: { severity: "high", cwe: "CWE-701", category: "abi.encodePacked hash collision (dynamic types)" },
   address_zero_check: { severity: "low", cwe: "CWE-20", category: "Missing address(0) validation on privileged assignment" }
 };
 function lines3(code) {
@@ -60649,7 +60672,7 @@ function web3Audit(code, file) {
   }
   const packedRe = /keccak256\s*\(\s*abi\.encodePacked\s*\(/g;
   while ((m = packedRe.exec(clean)) !== null) {
-    push(out, file, code, m.index, "encodePacked_collision", (ls[lineNo4(code, m.index) - 1] ?? "").trim(), "`keccak256(abi.encodePacked(...))` over dynamic types (string/bytes/array) is ambiguous — ['a','bc'] and ['ab','c'] pack identically, enabling hash collisions and signature forgery (CWE-701). Use `abi.encode` (which pads + length-prefixes each argument) for any hash or signature digest.");
+    push(out, file, code, m.index, "encode_packed_collision", (ls[lineNo4(code, m.index) - 1] ?? "").trim(), "`keccak256(abi.encodePacked(...))` over dynamic types (string/bytes/array) is ambiguous — ['a','bc'] and ['ab','c'] pack identically, enabling hash collisions and signature forgery (CWE-701). Use `abi.encode` (which pads + length-prefixes each argument) for any hash or signature digest.");
   }
   const zeroCheckRe = /\b(constructor|initialize|setOwner|transferOwnership|setAdmin|setFeeRecipient|setPendingOwner)\s*\(/g;
   const cleanLines = lines3(clean);
@@ -60790,7 +60813,7 @@ contract Evil {
         vm.expectRevert(); // or assert gas consumption
         target.processAll();
     }`,
-    encodePacked_collision: `    function testEncodePackedCollision() public {
+    encode_packed_collision: `    function testEncodePackedCollision() public {
         // two distinct inputs pack to the same hash
         bytes32 a = target.hashFor("a", "bc");
         bytes32 b = target.hashFor("ab", "c");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.86",
+  "version": "2.4.88",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {