nx_ad_banner_builder_gate.nx source

1// nx_ad_banner_builder_gate.nx -- GATE for the server-rendered banner builder. Proves: the GET form has the 2// fields and is ZERO-JS; a POST renders a clean generated banner (correct size + animation) with the form 3// repopulated; an injected sponsor stays escaped; empty input yields no banner. Emits the builder page 4// samples to knowledge/staging/ad/ as evidence. Sovereign, no gcc/.sh. license_tier: ORIGINAL 5import "nx_ad_banner_builder.nx" 6import "nx_ad_serve.nx" 7import "nx_syscalls.nx" 8 9func g_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 10func g_write(fname: *u8, buf: *u8, n: i64) -> i64 { let fd: i64 = sys_openat_wr(fname, 420); if fd >= 0 { sys_write(fd, buf, n); sys_close(fd) } return 0 } 11 12func main(argc: i64, argv: *i64) -> i64 { 13 g_p("=== nx_ad_banner_builder_gate ===\n" as *u8) 14 let page: *u8 = sys_mmap(65536) 15 var pass: i64 = 0 16 var tot: i64 = 0 17 18 // ---- T1: GET (empty body) -> the form, zero JS, no preview yet. 19 let empty: *u8 = sys_mmap(8); empty[0] = 0 as u8 20 let g1: i64 = abb_page(empty, 0, page) 21 g_write("knowledge/staging/ad/banner_builder.html" as *u8, page, g1) 22 tot = tot + 1; var ok1: i64 = 1 23 if as_contains(page, g1, "name='business'" as *u8) != 1 { ok1 = 0 } 24 if as_contains(page, g1, "leaderboard" as *u8) != 1 { ok1 = 0 } 25 if as_contains(page, g1, "dynamic" as *u8) != 1 { ok1 = 0 } 26 if as_contains(page, g1, "<script" as *u8) != 0 { ok1 = 0 } // builder is ZERO-JS 27 if as_contains(page, g1, "Preview" as *u8) != 0 { ok1 = 0 } // nothing generated yet 28 if ok1 == 1 { pass = pass + 1; g_p("PASS T1 GET form: fields present, zero-JS, no preview\n" as *u8) } else { g_p("FAIL T1\n" as *u8) } 29 30 // ---- T2: POST a submission -> generated banner preview (728x90 dynamic) + repopulated + copy box, zero-JS. 31 let post: *u8 = "business=Acme+Co&headline=Big+sale&body=Up+to+40%25+off&cta=Shop+now&link=https://acme.test/&size=leaderboard+728x90&theme=dark&kind=dynamic+(animated)" as *u8 32 let pn: i64 = as_len(post) 33 let g2: i64 = abb_page(post, pn, page) 34 g_write("knowledge/staging/ad/banner_builder_filled.html" as *u8, page, g2) 35 tot = tot + 1; var ok2: i64 = 1 36 if as_contains(page, g2, "width:728px" as *u8) != 1 { ok2 = 0 } // requested size honored 37 if as_contains(page, g2, "@keyframes" as *u8) != 1 { ok2 = 0 } // dynamic animation present 38 if as_contains(page, g2, "Preview" as *u8) != 1 { ok2 = 0 } // preview rendered 39 if as_contains(page, g2, "<textarea" as *u8) != 1 { ok2 = 0 } // copy-paste HTML box 40 if as_contains(page, g2, "value='Acme Co'" as *u8) != 1 { ok2 = 0 } // form repopulated (decoded) 41 if as_contains(page, g2, "<script" as *u8) != 0 { ok2 = 0 } // STILL zero-JS 42 if ok2 == 1 { pass = pass + 1; g_p("PASS T2 POST: 728x90 dynamic preview + repopulated + copy box, zero-JS\n" as *u8) } else { g_p("FAIL T2\n" as *u8) } 43 44 // ---- T3: abb_render direct -> non-empty for a real form, and EMPTY (0) when no business given. 45 let buf: *u8 = sys_mmap(16384) 46 let r1: i64 = abb_render(post, pn, buf) 47 let noform: *u8 = "headline=x" as *u8 48 let r0: i64 = abb_render(noform, as_len(noform), buf) 49 tot = tot + 1; var ok3: i64 = 1 50 if r1 <= 0 { ok3 = 0 } 51 if r0 != 0 { ok3 = 0 } // no business -> no banner (fail-closed on empty) 52 if ok3 == 1 { pass = pass + 1; g_p("PASS T3 abb_render: generates for a form, returns 0 with no business\n" as *u8) } else { g_p("FAIL T3\n" as *u8) } 53 54 // ---- T4: ESCAPING neg-control -> an injected sponsor never appears raw in the page (escaped in BOTH 55 // the repopulated form value and the generated banner). 56 let inj: *u8 = "business=<script>alert(1)</script>&headline=H&size=rectangle&kind=static" as *u8 57 let g4: i64 = abb_page(inj, as_len(inj), page) 58 tot = tot + 1; var ok4: i64 = 1 59 if as_contains(page, g4, "<script" as *u8) != 0 { ok4 = 0 } // raw injection absent 60 if as_contains(page, g4, "&lt;script" as *u8) != 1 { ok4 = 0 } // present only escaped 61 if ok4 == 1 { pass = pass + 1; g_p("PASS T4 escaping: injected sponsor stays &lt;script (no raw tag)\n" as *u8) } else { g_p("FAIL T4\n" as *u8) } 62 63 g_p("nx_ad_banner_builder_gate pass=" as *u8) 64 let nb: *u8 = sys_mmap(16); let nn: i64 = ab_uitoa(nb, 0, pass); sys_write(1, nb, nn) 65 g_p("/" as *u8); let tb: *u8 = sys_mmap(16); let tn: i64 = ab_uitoa(tb, 0, tot); sys_write(1, tb, tn) 66 if pass == tot { g_p(" verdict=GREEN\n" as *u8); return 0 } 67 g_p(" verdict=RED\n" as *u8) 68 return 1 69}