nx_clean_url_gate.nx source

1// nx_clean_url_gate.nx -- gate for the clean-URL layer: the general extensionless resolve rule + traversal safety 2// + a clean-link audit run on the REAL andelin_branded.html. 100% sovereign. expect_exit: 0 3import "nx_syscalls.nx" 4import "nx_sitegate_emit_lib.nx" 5import "nx_clean_url.nx" 6 7 8func g_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 9func g_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8){ if a[i]!=b[i] { return 0 } i=i+1 } if b[i]!=(0 as u8){ return 0 } return 1 } 10func inbandc(v: i64, lo: i64, hi: i64) -> i64 { if v < lo { return 0 } if v > hi { return 0 } return 1 } 11// resolve `req` and compare to `want` 12func chk(req: *u8, want: *u8) -> i64 { 13 let out: *u8 = sys_mmap(512) 14 let r: i64 = cu_resolve(req, g_len(req), out, 512) 15 gw(" " as *u8); gw(req); gw(" -> " as *u8); if r < 0 { gw("(rejected)" as *u8) } else { gw(out) } gw("\n" as *u8) 16 if r < 0 { return 0 } 17 return g_streq(out, want) 18} 19 20func main() -> i64 { 21 let tot: *i64 = sys_mmap(32) as *i64 22 tot[0]=0; tot[1]=0 23 gw("=== nx_clean_url_gate -- extensionless URL resolve + clean-link audit ===\n" as *u8) 24 25 t_row("C1 / -> index.html" as *u8, chk("/" as *u8, "index.html" as *u8), tot) 26 t_row("C2 /schedule -> schedule.html (the clean URL)" as *u8, chk("/schedule" as *u8, "schedule.html" as *u8), tot) 27 t_row("C3 /about/ -> about/index.html" as *u8, chk("/about/" as *u8, "about/index.html" as *u8), tot) 28 t_row("C4 /style.css -> style.css (already has an extension)" as *u8, chk("/style.css" as *u8, "style.css" as *u8), tot) 29 t_row("C5 /a/b -> a/b.html (nested clean URL)" as *u8, chk("/a/b" as *u8, "a/b.html" as *u8), tot) 30 31 // C6 traversal rejected 32 let tb: *u8 = sys_mmap(512) 33 let r6: i64 = cu_resolve("/../etc/passwd" as *u8, g_len("/../etc/passwd" as *u8), tb, 512) 34 t_row("C6 NEG: /../etc/passwd REJECTED (no traversal)" as *u8, inbandc(r6, 0-1, 0-1), tot) 35 36 // C7 audit the REAL andelin_branded.html -> 0 .html links 37 let lp: *i64 = sys_mmap(16) as *i64 38 let page: *u8 = sys_read_file("web_assets/andelin_branded.html" as *u8, lp) 39 let pn: i64 = lp[0] 40 var off: i64 = 0 - 1 41 if (page as i64) != 0 { if pn > 0 { off = cu_audit_links(page, pn) } } 42 gw(" andelin_branded.html hrefs carrying .html = " as *u8); gn(off); gw("\n" as *u8) 43 t_row("C7 our real generated page links are clean (0 .html hrefs)" as *u8, inbandc(off, 0, 0), tot) 44 45 // C8 a dirty page is flagged 46 let dirty: *u8 = "<a href=\"/about.html\">About</a> <a href=\"/x\">X</a>" as *u8 47 let dn: i64 = g_len(dirty) 48 let off2: i64 = cu_audit_links(dirty, dn) 49 t_row("C8 a page with an /about.html link is FLAGGED (>=1)" as *u8, inbandc(off2, 1, 999), tot) 50 51 // C9 single-link predicate 52 var t9: i64 = 0 53 if cu_link_is_clean("/schedule" as *u8) == 1 { if cu_link_is_clean("/schedule.html" as *u8) == 0 { if cu_link_is_clean("#consult" as *u8) == 1 { t9 = 1 } } } 54 t_row("C9 cu_link_is_clean: /schedule + #consult clean, /schedule.html not" as *u8, t9, tot) 55 56 gw("\nrows pass=" as *u8); gn(tot[0]); gw(" fail=" as *u8); gn(tot[1]); gw("\n" as *u8) 57 if tot[1] == 0 { gw("VERDICT=GREEN -- clean-URL resolve rule + link audit work; our pages link extensionless. Ready to wire into the sites daemon.\n" as *u8); return 0 } 58 gw("VERDICT=RED\n" as *u8) 59 return 1 60}