code wiki / _hdl_build / nx_cms_roles_exceed_gate.nx
nx_cms_roles_exceed_gate.nx
buildroot/runtime/_hdl_build/nx_cms_roles_exceed_gate.nx
about
nx_cms_roles_exceed_gate.nx -- W-RE-004 head-to-head EXCEED (roles-capabilities, TENANT-ISOLATION axis).
Runs BOTH authorizers on the SAME role x route matrix:
OURS = c0_authz_step_step (tenant-scoped FSM -- clientA scope != clientB scope)
INCUMBENT = a flat-role baseline that authorizes ANY authenticated client to ANY client-scope route
(ignores tenant) -- the CWE-639 authorization-bypass / IDOR failure mode that
WordPress subscriber-role + membership setups are repeatedly bitten by.
Ground truth: a client-scope route is allowed ONLY for its own tenant; admin routes only for admin;
anon only for public. Verdict COMPUTED by nx_cms_exceed. Writes CMSEXCEED feature=roles-capabilities
axis=tenant-isolation on a measured AHEAD + referee-clean + anti-false-green. license_tier: ORIGINAL
dependencies 3 imports · 0 importers
imports: nx_cms_exceed.nxc0_authz_step.nxnx_syscalls.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| none |
functions
| 14 | func rx_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } |
| 15 | func rx_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } |
| 16 | func rx_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o } called by 1: main |
| 17 | func rx_catnum(dst: *u8, off: i64, v: i64) -> i64 |
| 22 | func rx_row(id: i64, ok: i64, what: *u8) -> i64 |
| 30 | func rx_truth_allow(s: i64, e: i64) -> i64 called by 1: main |
| 38 | func rx_incumbent_allow(s: i64, e: i64) -> i64 called by 1: main |
| 45 | func main() -> i64 |