code wiki / _hdl_build / nx_cms_redirect_exceed_gate.nx

nx_cms_redirect_exceed_gate.nx

buildroot/runtime/_hdl_build/nx_cms_redirect_exceed_gate.nx

9175 B171 linesdepth 4pulls 6 transitivereach 0 importersview sourcekind gate/prooftopic cms

docs dependencies structs consts functions

about

nx_cms_redirect_exceed_gate.nx -- the FIRST W-RE-004 head-to-head EXCEED (redirects-404, safety axis). Runs BOTH sides on the SAME corpus of Location values: OURS = _redirect_location_is_safe (the shipped guard) INCUMBENT = the documented no-guard baseline (accept any non-empty Location) -- the CWE-113 / CWE-601 failure mode of redirect handlers that don't reject CR/LF/NUL in a Location (a class WordPress redirect plugins have shipped CVEs for). Ground truth per case: SAFE iff it contains no CR(0x0d)/LF(0x0a)/NUL(0x00). The harness nx_cms_exceed COMPUTES the verdict from the measured scores; the gate also self-tests that the harness CANNOT false-green (rejects an overclaim, reports PARITY/BEHIND honestly). Writes a CMSEXCEED line to knowledge/status/cms_exceed.log ONLY on a measured AHEAD + referee-clean + self-tests pass. Exit 0 iff so. license_tier: ORIGINAL

dependencies 3 imports · 0 importers

imports: nx_cms_exceed.nxnx_http_resolve_redirect.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

none

functions

16	func xg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 1: xg_row calls 1: sys_write
17	func xg_num(v: i64) -> i64 { let bb: u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } called by 1: xg_row calls 2: sys_mmap sys_write
18	func xg_cat(dst: u8, off: i64, s: u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o } called by 1: main
19	func xg_catnum(dst: *u8, off: i64, v: i64) -> i64 calls 1: sys_mmap
24	func xg_row(id: i64, ok: i64, what: *u8) -> i64 calls 2: xg_w xg_num
32	func xg_incumbent_accept(loc: *u8, n: i64) -> i64 { if n > 0 { return 1 } return 0 }
35	func xg_truth_safe(loc: *u8, n: i64) -> i64
48	func xg_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } called by 1: main
50	func main() -> i64 calls 3: sys_mmap xg_slen xg_cat