nx_cms_sanitize_probe_gate.nx source
↩ module page · 43 lines · 2262 B
1// nx_cms_sanitize_probe_gate.nx -- isolates ONE question: what does hs_sanitize DO to the exact
2// payload nx_cms_gate posts? Row 09 said benign <b> did not survive; the renderer is provably
3// correct (keys ending _html emit verbatim) and hs_sanitize's own KATs are 20/20, so the remaining
4// suspect is this specific shape: a stripped <script> IMMEDIATELY followed by an allowed tag.
5// Prints the actual bytes rather than asserting a theory. license_tier: ORIGINAL expect_exit: 0
6import "nx_gate_verdict.nx"
7import "nx_html_sanitize.nx"
8
9func pr_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
10
11func main() -> i64 {
12 let ctr: *i64 = gv_ctr()
13 gv_head("nx_cms_sanitize_probe_gate -- what does hs_sanitize emit for the cms_gate payload?" as *u8)
14
15 let inp: *u8 = "<script>alert(1)</script><b>Spring hours posted.</b>" as *u8
16 let out: *u8 = sys_mmap(4096)
17 let n: i64 = hs_sanitize(inp, pr_len(inp), out, 4095)
18 out[n] = 0 as u8
19 gv_puts(" IN : " as *u8); gv_puts(inp); gv_puts("\n" as *u8)
20 gv_puts(" OUT: " as *u8); gv_puts(out); gv_puts("\n" as *u8)
21 gv_puts(" outlen=" as *u8); gv_num(n); gv_puts("\n" as *u8)
22
23 // control: the SAME benign markup with no script in front
24 let inp2: *u8 = "<b>Spring hours posted.</b>" as *u8
25 let out2: *u8 = sys_mmap(4096)
26 let n2: i64 = hs_sanitize(inp2, pr_len(inp2), out2, 4095)
27 out2[n2] = 0 as u8
28 gv_puts(" CONTROL IN : " as *u8); gv_puts(inp2); gv_puts("\n" as *u8)
29 gv_puts(" CONTROL OUT: " as *u8); gv_puts(out2); gv_puts("\n\n" as *u8)
30
31 var has_b: i64 = 0
32 var i: i64 = 0
33 while i + 2 < n { if (out[i] as i64)==60 { if (out[i+1] as i64)==98 { if (out[i+2] as i64)==62 { has_b = 1 } } } i = i + 1 }
34 var ctl_b: i64 = 0
35 var j: i64 = 0
36 while j + 2 < n2 { if (out2[j] as i64)==60 { if (out2[j+1] as i64)==98 { if (out2[j+2] as i64)==62 { ctl_b = 1 } } } j = j + 1 }
37
38 gv_check("T1 CONTROL benign <b> alone survives sanitize" as *u8, ctl_b, ctr)
39 gv_check("T2 benign <b> survives when it FOLLOWS a stripped <script>" as *u8, has_b, ctr)
40
41 let rc: i64 = gv_verdict("CMS-SANITIZE-PROBE" as *u8, ctr, "sanitizer keeps allowed markup after a stripped script" as *u8)
42 sys_exit(rc)
43 return rc
44}