code wiki / _hdl_build / nx_clean_serve_gate.nx
nx_clean_serve_gate.nx source
↩ module page · 112 lines · 7992 B
1// nx_clean_serve_gate.nx -- ADVERSARY + CRITIC gate for the ethical clean-serve engine (the win-win-win proof).
2// ADVERSARY: a synthetic hostile page carrying every attack class a malvertising/pirate/adult site throws at a
3// user -- cryptominer, popunder window.open, reverse-tabnab link, meta-refresh malvertising, tracker beacon,
4// inline on*= handler, javascript: URI -- PLUS a benign static banner ad and the real video content.
5// CRITIC: after cs_clean_page, assert (a) EVERY attack is neutralized (nothing executable survives), (b) the
6// benign ad's creative + click SURVIVE (the site still monetizes), (c) the content + native media survive,
7// (d) the safety receipt counts are correct. NEGATIVE CONTROLS: a clean page must report ZERO attacks (no false
8// positive), and a miner-only page must NOT count the miner as a preserved ad. No fabricated greens. ORIGINAL
9import "nx_syscalls.nx"
10import "nx_web_filter.nx"
11import "nx_clean_serve.nx"
12
13// case-insensitive "does hay contain needle" (reuses cs_slen/cs_ci_at from the import)
14func g_has(hay: *u8, hl: i64, needle: *u8) -> i64 {
15 let nl: i64 = cs_slen(needle)
16 if nl==0 { return 1 }
17 if nl>hl { return 0 }
18 var i: i64 = 0; let last: i64 = hl-nl
19 while i<=last { if cs_ci_at(hay, hl, i, needle, nl)==1 { return 1 } i=i+1 }
20 return 0
21}
22// report one assertion; pt = [pass,total]
23func g_check(label: *u8, ok: i64, pt: *i64) -> i64 {
24 pt[1]=pt[1]+1
25 let buf: *u8 = sys_mmap(256); var o: i64 = 0
26 if ok==1 { o=cs_put(buf, 0, " [PASS] " as *u8); pt[0]=pt[0]+1 } else { o=cs_put(buf, 0, " [FAIL] " as *u8) }
27 o=cs_put(buf, o, label); buf[o]=10 as u8; o=o+1
28 sys_write(1, buf, o)
29 return 0
30}
31// assert a substring is ABSENT (attack neutralized)
32func g_absent(out: *u8, len: i64, needle: *u8, label: *u8, pt: *i64) -> i64 {
33 var ok: i64 = 0; if g_has(out, len, needle)==0 { ok=1 }
34 g_check(label, ok, pt); return 0
35}
36// assert a substring is PRESENT (content / safe ad preserved)
37func g_present(out: *u8, len: i64, needle: *u8, label: *u8, pt: *i64) -> i64 {
38 var ok: i64 = 0; if g_has(out, len, needle)==1 { ok=1 }
39 g_check(label, ok, pt); return 0
40}
41func g_ge(v: i64, min: i64, label: *u8, pt: *i64) -> i64 { var ok: i64=0; if v>=min { ok=1 } g_check(label, ok, pt); return 0 }
42func g_eq(v: i64, want: i64, label: *u8, pt: *i64) -> i64 { var ok: i64=0; if v==want { ok=1 } g_check(label, ok, pt); return 0 }
43
44func main(argc: i64, argv: *i64) -> i64 {
45 let t: *i64 = wf_new(); wf_seed(t)
46 let out: *u8 = sys_mmap(262144)
47 let pt: *i64 = sys_mmap(16) as *i64; pt[0]=0; pt[1]=0
48
49 // ============ ADVERSARY FIXTURE A: the hostile page (every attack class + a benign ad + the content) ========
50 // (single-quoted attrs so the Nishi string literal stays clean; the transform handles both quote styles)
51 let a: *u8 = "<html><head><meta http-equiv='refresh' content='0;url=https://scam.example/go'><script src='https://coinhive.com/miner.js'></script><script>window.open('https://cdn.example/popunder.js');fetch('https://google-analytics.com/collect?id=1');var m='https://phish.example/you-have-won';</script></head><body><h1>Video Title</h1><video src='https://cdn.example/stream.mp4' controls></video><a href='https://x.example/go' onclick='location=1'>bad</a><a href='https://juicyads.com/click?ad=1'><img src='https://juicyads.com/creative.jpg'></a><img src='https://cdn.example/poster.jpg'><a href='javascript:steal()'>x</a></body></html>" as *u8
52 let alen: i64 = cs_slen(a)
53 let rcA: *i64 = cs_rc_new()
54 let lenA: i64 = cs_clean_page(a, alen, t, out, 262144, rcA)
55 sys_write(1, "TEST A -- hostile page: attacks neutralized, content + safe ad preserved\n" as *u8, 72)
56 // CRITIC (a): nothing executable/attacking survives in the served HTML
57 g_absent(out, lenA, "<script" as *u8, "no <script> survives" as *u8, pt)
58 g_absent(out, lenA, "coinhive" as *u8, "cryptominer removed" as *u8, pt)
59 g_absent(out, lenA, "onclick" as *u8, "inline on*= handler stripped" as *u8, pt)
60 g_absent(out, lenA, "javascript:" as *u8, "javascript: URI neutralized" as *u8, pt)
61 g_absent(out, lenA, "http-equiv" as *u8, "meta-refresh redirect removed" as *u8, pt)
62 g_absent(out, lenA, "popunder" as *u8, "popunder script removed" as *u8, pt)
63 // CRITIC (b): the site still earns -- the benign ad creative + click survive, sanitized
64 g_present(out, lenA, "juicyads.com/creative.jpg" as *u8, "safe ad creative preserved" as *u8, pt)
65 g_present(out, lenA, "juicyads.com/click" as *u8, "safe ad click-through preserved" as *u8, pt)
66 g_present(out, lenA, "rel=\"noopener noreferrer nofollow\"" as *u8, "links hardened (rel=noopener)" as *u8, pt)
67 // CRITIC (c): the content the user came for survives
68 g_present(out, lenA, "<video" as *u8, "native HTML5 video preserved" as *u8, pt)
69 g_present(out, lenA, "stream.mp4" as *u8, "media URL preserved" as *u8, pt)
70 g_present(out, lenA, "poster.jpg" as *u8, "content image preserved" as *u8, pt)
71 // CRITIC (d): the safety receipt counts are honest
72 g_ge(rcA[CR_SCRIPTS], 2, "receipt: >=2 scripts removed" as *u8, pt)
73 g_ge(rcA[CR_HANDLERS], 1, "receipt: >=1 handler stripped" as *u8, pt)
74 g_ge(rcA[CR_REDIRECTS], 2, "receipt: >=2 redirect vectors (meta+js) neutralized" as *u8, pt)
75 g_ge(rcA[CR_MINER], 1, "receipt: miner request counted" as *u8, pt)
76 g_ge(rcA[CR_POPUP], 1, "receipt: popunder request counted" as *u8, pt)
77 g_ge(rcA[CR_MAL], 1, "receipt: malware/scam request counted" as *u8, pt)
78 g_ge(rcA[CR_TRACK], 1, "receipt: tracker request counted" as *u8, pt)
79 g_ge(rcA[CR_ADS_KEPT], 1, "receipt: >=1 safe ad preserved" as *u8, pt)
80
81 // ============ NEGATIVE CONTROL B: a CLEAN page must report ZERO attacks (no false positives) ============
82 let b: *u8 = "<html><body><h1>News Article</h1><p>Plain readable content, nothing hostile here.</p><a href='https://juicyads.com/click'><img src='https://juicyads.com/banner.jpg'></a><img src='https://cdn.example/photo.jpg'></body></html>" as *u8
83 let blen: i64 = cs_slen(b)
84 let rcB: *i64 = cs_rc_new()
85 let lenB: i64 = cs_clean_page(b, blen, t, out, 262144, rcB)
86 sys_write(1, "TEST B (neg-control) -- clean page: zero false-positive attacks, ad + content kept\n" as *u8, 83)
87 g_eq(rcB[CR_SCRIPTS], 0, "clean page: 0 scripts flagged" as *u8, pt)
88 g_eq(rcB[CR_HANDLERS], 0, "clean page: 0 handlers flagged" as *u8, pt)
89 g_eq(rcB[CR_REDIRECTS], 0, "clean page: 0 redirects flagged" as *u8, pt)
90 g_eq(rcB[CR_BLOCKED], 0, "clean page: 0 attack requests flagged" as *u8, pt)
91 g_ge(rcB[CR_ADS_KEPT], 1, "clean page: safe ad still preserved" as *u8, pt)
92 g_present(out, lenB, "juicyads.com/banner.jpg" as *u8, "clean page: ad creative kept" as *u8, pt)
93 g_present(out, lenB, "photo.jpg" as *u8, "clean page: content image kept" as *u8, pt)
94
95 // ============ NEGATIVE CONTROL C: a miner-only page -- miner is NOT miscounted as a preserved ad ============
96 let c: *u8 = "<html><body><script src='https://coinhive.com/miner.js'></script><p>hi</p></body></html>" as *u8
97 let clen: i64 = cs_slen(c)
98 let rcC: *i64 = cs_rc_new()
99 let lenC: i64 = cs_clean_page(c, clen, t, out, 262144, rcC)
100 sys_write(1, "TEST C (neg-control) -- miner-only page: miner removed, NOT counted as a safe ad\n" as *u8, 80)
101 g_eq(rcC[CR_MINER], 1, "miner counted as blocked" as *u8, pt)
102 g_eq(rcC[CR_ADS_KEPT], 0, "miner NOT miscounted as a preserved ad" as *u8, pt)
103 g_absent(out, lenC, "coinhive" as *u8, "miner-only: script removed" as *u8, pt)
104
105 // ============ VERDICT ============
106 let sum: *u8 = sys_mmap(128); var so: i64 = cs_put(sum, 0, "nx_clean_serve_gate pass=" as *u8)
107 so = cs_putn(sum, so, pt[0]); sum[so]=47 as u8; so=so+1; so = cs_putn(sum, so, pt[1])
108 if pt[0]==pt[1] { so = cs_put(sum, so, " verdict=GREEN\n" as *u8) } else { so = cs_put(sum, so, " verdict=RED\n" as *u8) }
109 sys_write(1, sum, so)
110 if pt[0]==pt[1] { return 0 }
111 return 1
112}