code wiki / _hdl_build / nx_cms_draft_exceed_gate.nx

nx_cms_draft_exceed_gate.nx

buildroot/runtime/_hdl_build/nx_cms_draft_exceed_gate.nx

7000 B124 linesdepth 3pulls 4 transitivereach 0 importersview sourcekind gate/prooftopic cms
docsdependenciesstructsconstsfunctions

about

nx_cms_draft_exceed_gate.nx -- W-RE-004 head-to-head EXCEED (draft-preview, XSS-SANITIZATION axis). Runs BOTH renderers on the SAME corpus of draft content (benign + stored-XSS payloads): OURS = hs_sanitize (KSES-style allowlist: strips <script> content, drops all attrs except safe a@href, kills javascript: schemes) INCUMBENT = raw passthrough (render untrusted draft content without sanitization) -- the CWE-79 stored-XSS failure mode of CMS preview/render paths. A render is SAFE iff the output contains no executable vector (<script / onerror / javascript:). Ground truth: a correct renderer is ALWAYS safe. Verdict COMPUTED by nx_cms_exceed. license_tier: ORIGINAL

dependencies 3 imports · 0 importers

nx_cms_exceed.nx nx_html_sanitize.nx nx_syscalls.nx nx_cms_draft_exceed_gate.nx

imports: nx_cms_exceed.nxnx_html_sanitize.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_mmap dx_slen hs_sanitize sys_mmap ↻ hs_emitb hs_name_at hs_alpha hs_lc hs_digit hs_lc ↻ hs_emit hs_emitb ↻ hs_find_gt hs_tag_allowed hs_skip_close hs_lc ↻ hs_find_gt ↻ hs_href_extract hs_lc ↻ hs_href_value hs_scheme_ok hs_lc ↻ dx_has_marker dx_find_lc dx_lc xcd_verdict dx_w sys_write dx_num sys_mmap ↻ sys_write ↻ xcd_vname dx_row dx_w ↻ dx_num ↻ xcd_referee_ok dx_cat dx_catnum sys_mmap ↻

structs

none

consts

none

functions

13func dx_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 2: dx_rowmain calls 1: sys_write
14func dx_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
called by 2: dx_rowmain calls 2: sys_mmapsys_write
15func dx_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o }
called by 1: main
16func dx_catnum(dst: *u8, off: i64, v: i64) -> i64
called by 1: main calls 1: sys_mmap
21func dx_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
called by 1: main
22func dx_lc(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c }
called by 1: dx_find_lc
24func dx_find_lc(hay: *u8, n: i64, needle: *u8) -> i64
called by 1: dx_has_marker calls 1: dx_lc
36func dx_has_marker(buf: *u8, n: i64) -> i64
called by 1: main calls 1: dx_find_lc
42func dx_row(id: i64, ok: i64, what: *u8) -> i64
called by 1: main calls 2: dx_wdx_num
49func main() -> i64
calls 16: sys_mmapdx_slenhs_sanitizedx_has_markerxcd_verdictdx_w+10