blitzstrike 2.4.95 → 2.4.96

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.96] — 2026-09-17
+
+### Security — self-audit (command injection + path traversal fixed)
+
+- `resolve_check(host)` interpolated the user-controlled host into a `curl` shell
+  string (`execSync`), allowing command injection (`host = "x.com; id"`). Now
+  validates the host against a strict hostname regex BEFORE any subprocess/DNS and
+  calls curl via `execFileSync` (array argv, no shell) — defense in depth.
+- `foundry_run(contract_name=...)` used the name as a filename under the temp
+  project without validation, allowing path traversal (`"../../evil"`). Now
+  sanitizes to a valid Solidity identifier (`[A-Za-z_][A-Za-z0-9_]*`), defaulting
+  to `Vulnerable` otherwise.
+- Added regression checks: `isValidHostname` rejects shell metacharacters
+  (`;`, backticks, `$()`, `|`, `../`, newlines); the identifier regex is shared.
+
 ## [2.4.95] — 2026-09-17
 
 ### Fixed — full interconnection audit (unreachable template + 2 ungrounded classes)

package/dist/index.js

@@ -17499,7 +17499,7 @@ var init_update = __esm(() => {
 import { readFileSync as readFileSync29, existsSync as existsSync16 } from "node:fs";
 import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
-import { execSync as execSync5 } from "node:child_process";
+import { execSync as execSync4 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
@@ -17516,13 +17516,13 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync5("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
     checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
   }
   try {
-    const published = execSync5("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
   } catch {
     checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
@@ -61408,7 +61408,8 @@ function parseTestResults(out) {
 }
 async function foundryRun(input) {
   const forge = findForge();
-  const name = input.contract_name ?? "Vulnerable";
+  const rawName = input.contract_name ?? "Vulnerable";
+  const name = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(rawName) ? rawName : "Vulnerable";
   if (!forge) {
     return {
       forge: null,
@@ -61459,11 +61460,15 @@ solc = "0.8.20"
 }
 
 // src/hunting-intel.ts
-import { execSync as execSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { resolve4 as resolve42, Resolver } from "node:dns/promises";
 import { readFileSync as readFileSync25 } from "node:fs";
 import { join as join24 } from "node:path";
 var BLOCKING_KEYWORDS = /internet positif|kominfo|\.go\.id\b|pemblokiran|ditutup|dilarang|akses dibatasi|blocked|restricted|illegal|advertencia|coljuegos|regulat|forbidden|this (site|website) has been (blocked|banned)/i;
+var HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+function isValidHostname(host) {
+  return host.length <= 253 && HOSTNAME_RE.test(host);
+}
 async function localResolve(host) {
   try {
     return await resolve42(host);
@@ -61484,7 +61489,7 @@ function probeBlockingPage(host, ip, timeoutMs = 8000) {
   for (const port of ["443", "80"]) {
     const scheme = port === "443" ? "https" : "http";
     try {
-      const out = execSync4(`curl -sk -m 6 --resolve ${host}:${port}:${ip} ${scheme}://${host}/ 2>/dev/null`, { encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
+      const out = execFileSync5("curl", ["-sk", "-m", "6", "--resolve", `${host}:${port}:${ip}`, `${scheme}://${host}/`], { encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
       const preview = out.replace(/\s+/g, " ").trim().slice(0, 300);
       if (!preview)
         continue;
@@ -61495,6 +61500,9 @@ function probeBlockingPage(host, ip, timeoutMs = 8000) {
 }
 async function resolveCheck(host) {
   const clean = host.replace(/^https?:\/\//, "").split("/")[0];
+  if (!isValidHostname(clean)) {
+    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "invalid", evidence: "not a valid hostname — rejected before DNS/subprocess" };
+  }
   const local = await localResolve(clean);
   const pub = await publicResolve(clean);
   if (local.length === 0 && pub.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.95",
+  "version": "2.4.96",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {