code wiki / _hdl_build / nx_cms_api_exceed_gate.nx

nx_cms_api_exceed_gate.nx

buildroot/runtime/_hdl_build/nx_cms_api_exceed_gate.nx

10274 B185 linesdepth 5pulls 8 transitivereach 0 importersview sourcekind gate/prooftopic cms
docsdependenciesstructsconstsfunctions

about

nx_cms_api_exceed_gate.nx -- W-RE-004 head-to-head EXCEED (rest-graphql-api, INJECTION-SAFETY axis). Runs BOTH serializers on the SAME corpus of field values (benign + quote-injection): OURS = cms_api_render_obj (nx_json_emit, RFC 8259 escaping) INCUMBENT = naive string-concat JSON (no escaping) -- the CWE-116 failure mode (improper output neutralization -> JSON injection / structure breakout). A serialization is CORRECT iff the output stays well-formed: exactly the expected number of UNESCAPED double-quotes (4 for one key+value object). A value containing a `"` breaks the naive concat (extra unescaped quotes) but ours escapes it. Verdict COMPUTED by nx_cms_exceed. license_tier: ORIGINAL

dependencies 4 imports · 0 importers

nx_cms_exceed.nx nx_cms_api.nx nx_syscalls.nx nx_gate_verdict.nx nx_cms_api_exceed_gate.nx

imports: nx_cms_exceed.nxnx_cms_api.nxnx_syscalls.nxnx_gate_verdict.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_mmap nxa_die sys_write sys_exit nxa_lock_take nxa_lock_addr sys_write ↻ nxa_lock_give nxa_lock_addr ↻ nxa_report_overrun sys_write ↻ nxa_dump_printable sys_write ↻ nxa_dump_sizes sys_write ↻ ax_build_store ax_cat cms_api_render_obj sys_mmap ↻ json_writer_init cms_api_emit_obj sys_mmap ↻ json_begin_object je_sep je_put je_put ↻ cst_get sys_mmap ↻ cst_find cst_slen json_emit_key je_sep ↻ je_emit_string_raw je_put ↻ je_put ↻ capi_slen json_emit_string je_sep ↻ je_emit_string_raw ↻

structs

none

consts

none

functions

14func ax_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 2: ax_rowmain calls 1: sys_write
17func ax_w2(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
called by 1: ax_finish calls 1: sys_write
28func ax_finish(ok: i64) -> i64
called by 1: main calls 7: sys_openat_appendax_w2sys_closegv_ctrgv_checkgv_verdict+1
45func ax_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
46func ax_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o }
47func ax_catnum(dst: *u8, off: i64, v: i64) -> i64
52func ax_row(id: i64, ok: i64, what: *u8) -> i64
60func ax_unescaped_quotes(buf: *u8, n: i64) -> i64
73func ax_naive_render(key: *u8, val: *u8, vl: i64, out: *u8) -> i64
85func ax_build_store(val: *u8, vl: i64, out: *u8) -> i64
92func main() -> i64