nx_redirect_resolve_test.nx
buildroot/runtime/nx_redirect_resolve_test.nx
about
nx_redirect_resolve_test.nx -- X-HTTP-RELLOC-001 KAT: redirect-Location
resolution + https-only safety gate for the sovereign nish browser.
Base mirrors the RFC3986 ยง5.2 normative example (https + a.com authority)
so the path arithmetic is the already-proven nx_url_resolve behaviour;
this gate proves the WIRING (relative refs followed, downgrades refused).
base = "https://a.com/b/c/d;p?q"
C1 absolute https "https://x.com/y" -> follow "https://x.com/y"
C2 path-absolute "/g" -> follow "https://a.com/g"
C3 path-relative "g" -> follow "https://a.com/b/c/g"
C4 scheme-relative "//h.com/p" -> follow "https://h.com/p"
C5 dot-segments "../g" -> follow "https://a.com/b/g"
C6 http downgrade "http://evil/x" -> REFUSE (0) [no downgrade]
C7 cross-scheme "ftp://x/y" -> REFUSE (0) [https-only]
C8 google live case "/webhp" -> follow "https://www.google.com/webhp"
C9 empty Location "" -> REFUSE (0)
C6/C7/C9 are the negative controls: the gate must DISCRIMINATE, not just
pass everything. expect_exit: 0
license_tier: ORIGINAL
dependencies 2 imports · 0 importers
imports: nx_syscalls.nxnx_redirect_resolve.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| none |
functions
| 26 | func _strlen(s: *u8) -> i64 called by 1: _ck |
| 32 | func _eq(a: *u8, an: i64, b: *u8, bn: i64) -> i64 called by 1: _ck |
| 44 | func _ck(base_id: i64, base: *u8, loc: *u8, expect_follow: i64, exp_target: *u8) -> i64 |
| 59 | func main() -> i64 |