nx_ad_serve_gate.nx source

1// nx_ad_serve_gate.nx -- GATE (runnable) for ADS-004 the "Brought to you by" placement. Proves on 2// baked controls that the placement is clean + safe + that the third-party-JS detector actually 3// fires (anti-false-green): 4// clean : emit a real sponsor byline -> contains "Brought to you by" + the sponsor, AND 5// has_thirdparty_js == 0 (no <script>/<iframe>/src=/<object>/<embed>) 6// escape : a sponsor named "<script>alert(1)</script>" is HTML-ESCAPED -> the emitted markup has 7// NO live "<script" tag (it became &lt;script&gt;), has_thirdparty_js == 0 (XSS-safe) 8// DETECT : a planted "<script src='//evil'>" control -> has_thirdparty_js == 1 (proves the 9// detector catches injection; stuck-at-0 would RED-fail this) 10// 11// Evidence -> knowledge/status/ad_serve.log (SERVEGATE authored=organ ... verdict=GREEN). 12// license_tier: ORIGINAL 13import "nx_ad_serve.nx" 14import "nx_syscalls.nx" 15 16const SG_LOG: *u8 = "knowledge/status/ad_serve.log" 17 18func sg_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 19func sg_wn(fd: i64, v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(fd, bb, k); return 0 } 20 21func sg_emit(fd: i64, clean_3p: i64, has_byline: i64, has_sponsor: i64, esc_3p: i64, esc_neutralized: i64, detect_fired: i64, ok: i64) -> i64 { 22 sg_w(fd, "SERVEGATE authored=organ clean_thirdparty_js=" as *u8); sg_wn(fd, clean_3p) 23 sg_w(fd, " has_byline=" as *u8); sg_wn(fd, has_byline) 24 sg_w(fd, " has_sponsor=" as *u8); sg_wn(fd, has_sponsor) 25 sg_w(fd, " escaped_thirdparty_js=" as *u8); sg_wn(fd, esc_3p) 26 sg_w(fd, " escaped_neutralized=" as *u8); sg_wn(fd, esc_neutralized) 27 sg_w(fd, " detector_fired=" as *u8); sg_wn(fd, detect_fired) 28 if ok == 1 { sg_w(fd, " verdict=GREEN\n" as *u8) } else { sg_w(fd, " verdict=RED\n" as *u8) } 29 return 0 30} 31 32func main() -> i64 { 33 let out: *u8 = sys_mmap(4096) 34 35 // clean control: a real sponsor byline. 36 let biz: *u8 = "Acme Coffee" as *u8 37 let msg: *u8 = "Locally roasted, neighbor-owned." as *u8 38 let n1: i64 = as_emit_banner(biz, as_len(biz), msg, as_len(msg), out) 39 let clean_3p: i64 = as_has_thirdparty_js(out, n1) // expect 0 40 let has_byline: i64 = as_contains(out, n1, "Brought to you by" as *u8) // expect 1 41 let has_sponsor: i64 = as_contains(out, n1, "Acme Coffee" as *u8) // expect 1 42 43 // escape control: a malicious sponsor name must be neutralized. 44 let evil: *u8 = "<script>alert(1)</script>" as *u8 45 let out2: *u8 = sys_mmap(4096) 46 let n2: i64 = as_emit_banner(evil, as_len(evil), msg, as_len(msg), out2) 47 let esc_3p: i64 = as_has_thirdparty_js(out2, n2) // expect 0 (escaped, no live tag) 48 let esc_neutralized: i64 = as_contains(out2, n2, "&lt;script&gt;" as *u8) // expect 1 (escaped form present) 49 50 // detector proof: a planted third-party tag MUST be caught. 51 let bad: *u8 = "<div><script src='//evil.example/x.js'></script></div>" as *u8 52 let detect_fired: i64 = as_has_thirdparty_js(bad, as_len(bad)) // expect 1 53 54 var ok: i64 = 1 55 if clean_3p != 0 { ok = 0 } 56 if has_byline != 1 { ok = 0 } 57 if has_sponsor != 1 { ok = 0 } 58 if esc_3p != 0 { ok = 0 } 59 if esc_neutralized != 1 { ok = 0 } 60 if detect_fired != 1 { ok = 0 } 61 62 sg_emit(1, clean_3p, has_byline, has_sponsor, esc_3p, esc_neutralized, detect_fired, ok) 63 let lf: i64 = sys_openat_append(SG_LOG, 420) 64 if lf >= 0 { sg_emit(lf, clean_3p, has_byline, has_sponsor, esc_3p, esc_neutralized, detect_fired, ok); sys_close(lf) } 65 66 if ok == 1 { return 0 } 67 return 1 68}