nx_ad_serve_gate.nx source

1// nx_ad_serve_gate.nx -- GATE (runnable) for ADS-004 the "Brought to you by" placement. Proves on 2// baked controls that the placement is clean + safe + that the third-party-JS detector actually 3// fires (anti-false-green): 4// clean : emit a real sponsor byline -> contains "Brought to you by" + the sponsor, AND 5// has_thirdparty_js == 0 (no <script>/<iframe>/src=/<object>/<embed>) 6// escape : a sponsor named "<script>alert(1)</script>" is HTML-ESCAPED -> the emitted markup has 7// NO live "<script" tag (it became &lt;script&gt;), has_thirdparty_js == 0 (XSS-safe) 8// DETECT : a planted "<script src='//evil'>" control -> has_thirdparty_js == 1 (proves the 9// detector catches injection; stuck-at-0 would RED-fail this) 10// 11// Evidence -> knowledge/status/ad_serve.log (SERVEGATE authored=organ ... verdict=GREEN). 12// license_tier: ORIGINAL 13import "nx_ad_serve.nx" 14import "nx_syscalls.nx" 15import "nx_gate_verdict.nx" 16 17const SG_LOG: *u8 = "knowledge/status/ad_serve.log" 18 19func sg_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 20func sg_wn(fd: i64, v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(fd, bb, k); return 0 } 21 22func sg_emit(fd: i64, clean_3p: i64, has_byline: i64, has_sponsor: i64, esc_3p: i64, esc_neutralized: i64, detect_fired: i64, ok: i64) -> i64 { 23 sg_w(fd, "SERVEGATE authored=organ clean_thirdparty_js=" as *u8); sg_wn(fd, clean_3p) 24 sg_w(fd, " has_byline=" as *u8); sg_wn(fd, has_byline) 25 sg_w(fd, " has_sponsor=" as *u8); sg_wn(fd, has_sponsor) 26 sg_w(fd, " escaped_thirdparty_js=" as *u8); sg_wn(fd, esc_3p) 27 sg_w(fd, " escaped_neutralized=" as *u8); sg_wn(fd, esc_neutralized) 28 sg_w(fd, " detector_fired=" as *u8); sg_wn(fd, detect_fired) 29 if ok == 1 { sg_w(fd, " verdict=GREEN\n" as *u8) } else { sg_w(fd, " verdict=RED\n" as *u8) } 30 return 0 31} 32 33func main() -> i64 { 34 let out: *u8 = sys_mmap(4096) 35 36 // clean control: a real sponsor byline. 37 let biz: *u8 = "Acme Coffee" as *u8 38 let msg: *u8 = "Locally roasted, neighbor-owned." as *u8 39 let n1: i64 = as_emit_banner(biz, as_len(biz), msg, as_len(msg), out) 40 let clean_3p: i64 = as_has_thirdparty_js(out, n1) // expect 0 41 let has_byline: i64 = as_contains(out, n1, "Brought to you by" as *u8) // expect 1 42 let has_sponsor: i64 = as_contains(out, n1, "Acme Coffee" as *u8) // expect 1 43 44 // escape control: a malicious sponsor name must be neutralized. 45 let evil: *u8 = "<script>alert(1)</script>" as *u8 46 let out2: *u8 = sys_mmap(4096) 47 let n2: i64 = as_emit_banner(evil, as_len(evil), msg, as_len(msg), out2) 48 let esc_3p: i64 = as_has_thirdparty_js(out2, n2) // expect 0 (escaped, no live tag) 49 let esc_neutralized: i64 = as_contains(out2, n2, "&lt;script&gt;" as *u8) // expect 1 (escaped form present) 50 51 // detector proof: a planted third-party tag MUST be caught. 52 let bad: *u8 = "<div><script src='//evil.example/x.js'></script></div>" as *u8 53 let detect_fired: i64 = as_has_thirdparty_js(bad, as_len(bad)) // expect 1 54 55 var ok: i64 = 1 56 if clean_3p != 0 { ok = 0 } 57 if has_byline != 1 { ok = 0 } 58 if has_sponsor != 1 { ok = 0 } 59 if esc_3p != 0 { ok = 0 } 60 if esc_neutralized != 1 { ok = 0 } 61 if detect_fired != 1 { ok = 0 } 62 63 sg_emit(1, clean_3p, has_byline, has_sponsor, esc_3p, esc_neutralized, detect_fired, ok) 64 let lf: i64 = sys_openat_append(SG_LOG, 420) 65 if lf >= 0 { sg_emit(lf, clean_3p, has_byline, has_sponsor, esc_3p, esc_neutralized, detect_fired, ok); sys_close(lf) } 66 67 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 68 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 69 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 70 let ctr__dry: *i64 = gv_ctr() 71 ctr__dry[0] = ok 72 ctr__dry[1] = 1 73 let rc__dry: i64 = gv_verdict("AD-SERVE-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8) 74 sys_exit(rc__dry) 75 return rc__dry 76}