code wiki / _hdl_build / nx_cms_redirect_gate.nx
`nx_cms_redirect_gate.nx` source

1// nx_cms_redirect_gate.nx -- CMS REDIRECTS gate (land a missing class HONESTLY). Proves the team's
2// real redirect organs AS A CMS CAPABILITY: RFC 7231 status codes per redirect kind (nx_http_redirect)
3// + the safe-location guard that REJECTS CRLF/NUL header-injection in a Location (the security exceed
4// over WP redirect plugins, which have had open-redirect/header-injection CVEs). Writes CMSGATE
5// redirects-404 verdict=PASS to cms_gate.log ONLY if all assertions hold (no fake-green).
6import "nx_http_redirect.nx"
7import "nx_http_resolve_redirect.nx"
8import "nx_syscalls.nx"
9
10func dg_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
11func dg_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
12func dg_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
13
14func main() -> i64 {
15    var pass: i64 = 0
16    var total: i64 = 0
17    // RFC 7231 status codes per kind
18    total = total + 1; if nxr_kind_status_code(NXR_PERMANENT_301) == 301 { pass = pass + 1 }
19    total = total + 1; if nxr_kind_status_code(NXR_SEE_OTHER_303) == 303 { pass = pass + 1 }
20    total = total + 1; if nxr_kind_status_code(NXR_TEMP_307) == 307 { pass = pass + 1 }
21    total = total + 1; if nxr_kind_status_code(NXR_PERM_308) == 308 { pass = pass + 1 }
22    // safe-location: a clean relative Location is accepted
23    let good: *u8 = "/practice/estate-planning" as *u8
24    total = total + 1; if _redirect_location_is_safe(good, dg_len(good)) == 1 { pass = pass + 1 }
25    // safe-location: a CRLF-injected Location is REJECTED (header-injection defense = the exceed)
26    let bad: *u8 = sys_mmap(64)
27    bad[0]=0x2f; bad[1]=0x78; bad[2]=0x0d; bad[3]=0x0a; bad[4]=0x53; bad[5]=0x65; bad[6]=0x74; bad[7]=0x3a  // "/x\r\nSet:"
28    total = total + 1; if _redirect_location_is_safe(bad, 8) == 0 { pass = pass + 1 }
29
30    dg_puts("CMS-REDIRECT-GATE rfc7231-codes + safe-location pass=" as *u8); dg_num(pass); dg_puts("/" as *u8); dg_num(total)
31    dg_puts(" (301/303/307/308 + CRLF-injection rejected)\n" as *u8)
32
33    if pass == total {
34        let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4)
35        if gf >= 0 {
36            let line: *u8 = "CMSGATE row=nx_cms_redirect redirects-404 codes=4 safeloc=2 pass=6 verdict=PASS\n" as *u8
37            sys_write(gf, line, dg_len(line)); sys_close(gf)
38        }
39        dg_puts("CMS-REDIRECT-GATE verdict=PASS -- redirects-404 recorded in cms_gate.log\n" as *u8)
40        sys_exit(0); return 0
41    }
42    dg_puts("CMS-REDIRECT-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8)
43    sys_exit(1); return 1
44}
nx_cms_redirect_gate.nx source

`nx_cms_redirect_gate.nx` source
