blitzstrike 2.4.87 → 2.4.88

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.88] — 2026-09-17
+
+### Changed — XSS detector precision (local taint flow)
+
+- `xss` no longer flags a DOM sink merely because a source exists somewhere in the
+  same file. It now builds a tainted-variable set via assignment flow (transitive,
+  ≤3 hops) and flags a sink only when its argument references a tainted variable or
+  is a direct source expression. Removes the "source + sink co-occurrence" false
+  positives (4 FPs on the 30-lab benchmark) with zero recall loss.
+
 ## [2.4.87] — 2026-09-17
 
 ### Fixed — web3 class naming consistency + jwt grounding

package/dist/index.js

@@ -16937,11 +16937,34 @@ function detectCorsMisconfig(code, file, out) {
 function detectXss(code, file, out) {
   const clean = stripCommentsOnly(code);
   const ls = lines2(code);
-  const hasSource = /\b(?:req\.(?:query|params|body|cookies|headers)|request\.(?:get|args|form|json|values|headers|params)|location\.(?:hash|search|href)|window\.location|document\.(?:URL|referrer)|URLSearchParams|searchParams\.get|getElementById\([^)]*\)\.value|routeParams|queryParams|this\.props|params\s*[:=])/i.test(clean) || /\b(?:req\.(?:query|params|body)|request\.(?:get|args|json|values)|location\.(?:hash|search))\b/i.test(clean);
-  if (!hasSource)
+  const isSourceExpr = (expr) => /\b(?:req\.(?:query|params|body|cookies|headers)|request\.(?:get|args|form|json|values|headers|params)|location\.(?:hash|search|href)|window\.location|document\.(?:URL|referrer)|URLSearchParams|searchParams\.get|getElementById\([^)]*\)\.value|routeParams|queryParams|this\.props)\b/i.test(expr);
+  const tainted = new Set;
+  const assignments = [];
+  const assignRe = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)|(?<![\w$.])([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+  let m;
+  while ((m = assignRe.exec(clean)) !== null) {
+    const lhs = m[1] ?? m[3];
+    const rhs = (m[2] ?? m[4] ?? "").trim();
+    if (lhs)
+      assignments.push({ lhs, rhs });
+  }
+  for (let hop = 0;hop < 3; hop++) {
+    let changed = false;
+    for (const a of assignments) {
+      if (tainted.has(a.lhs))
+        continue;
+      const refsTainted = [...tainted].some((t) => new RegExp(`\\b${t}\\b`).test(a.rhs));
+      if (isSourceExpr(a.rhs) || refsTainted) {
+        tainted.add(a.lhs);
+        changed = true;
+      }
+    }
+    if (!changed)
+      break;
+  }
+  if (tainted.size === 0)
     return;
   const sinkRe = /dangerouslySetInnerHTML|\.innerHTML\s*=|\.outerHTML\s*=|document\.write\s*\(|insertAdjacentHTML\s*\(|\.html\s*\(|eval\s*\(/g;
-  let m;
   const seen = new Set;
   while ((m = sinkRe.exec(clean)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16951,9 +16974,8 @@ function detectXss(code, file, out) {
     const rest = line.slice(line.indexOf(m[0]) + m[0].length);
     if (/^\s*["'`]/.test(rest))
       continue;
-    if (m[0] === "eval(" && /^\s*["'`]/.test(rest))
-      continue;
-    if (m[0] === "dangerouslySetInnerHTML" && !/__html\s*:\s*[^'"`]/.test(line))
+    const refsTainted = [...tainted].some((t) => new RegExp(`\\b${t}\\b`).test(rest));
+    if (!refsTainted && !isSourceExpr(rest))
       continue;
     seen.add(ln);
     out.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.87",
+  "version": "2.4.88",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {