code wiki / _hdl_build / nx_cms_visual_builder_gate.nx

nx_cms_visual_builder_gate.nx source

↩ module page · 99 lines · 5670 B

1// nx_cms_visual_builder_gate.nx -- referee for R-CANVAS v1 (nx_cms_visual_builder): the visual no-JS site 2// editor lib. Proves: the form prefills from a real blueprint (attribute-escaped), the server-side rebuild 3// reconstructs a valid blueprint from posted urlencoded fields (decoded, blank cards omitted), and the 4// format cannot be injected ('|' in a value neutralized; missing title -> a blueprint the daemon's validator 5// refuses). GREEN iff 7/7. license_tier: ORIGINAL expect_exit: 0 6import "nx_gate.nx" 7import "nx_cms_visual_builder.nx" 8 9func vg_has(hay: *u8, hn: i64, needle: *u8) -> i64 { 10 if (hay as i64)==0 { return 0 } 11 var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1} 12 if nl==0 { return 1 } 13 var i: i64=0 14 while i+nl<=hn { var j: i64=0; var ok: i64=1; while j<nl { if (hay[i+j] as i64)!=(needle[j] as i64) { ok=0; j=nl } else { j=j+1 } } if ok==1 { return 1 } i=i+1 } 15 return 0 16} 17func vg_count(hay: *u8, hn: i64, needle: *u8) -> i64 { 18 if (hay as i64)==0 { return 0 } 19 var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1} 20 if nl==0 { return 0 } 21 var c: i64=0 22 var i: i64=0 23 while i+nl<=hn { var j: i64=0; var ok: i64=1; while j<nl { if (hay[i+j] as i64)!=(needle[j] as i64) { ok=0; j=nl } else { j=j+1 } } if ok==1 { c=c+1; i=i+nl } else { i=i+1 } } 24 return c 25} 26func vg_row(name: *u8, ok: i64) -> i64 { gw(" " as *u8); gw(name); if ok==1 { gw(" PASS\n" as *u8) } else { gw(" FAIL\n" as *u8) } return 0 } 27 28func main() -> i64 { 29 // fixture blueprint (a quote in a card body exercises attribute escaping) 30 let cfg: *u8 = "title|Old Title\nheader|Brand|Call now|/\nhero|Big H|Sub S\nsearch|/search|Find\ncard|Card One|We say \"hello\" here\ncard|Card Two|Second body\nstep|Step A\nsig|Trusted\nfooter|F text\n" as *u8 31 var cn: i64 = 0 32 while cfg[cn] != (0 as u8) { cn = cn + 1 } 33 let body: *u8 = sys_mmap(300000) 34 let bl: i64 = vb_form_page(cfg, cn, "TOK" as *u8, 3, body, 0) 35 // T1: prefilled fields (hero, card 1 name, footer) land as input values 36 var t1: i64=0 37 if vg_has(body, bl, "value=\"Big H\"" as *u8)==1 { if vg_has(body, bl, "value=\"Card One\"" as *u8)==1 { if vg_has(body, bl, "value=\"F text\"" as *u8)==1 { t1=1 } } } 38 // T2: attribute escaping -- the quoted card body renders &quot; 39 var t2: i64=0 40 if vg_has(body, bl, "We say &quot;hello&quot; here" as *u8)==1 { t2=1 } 41 // T3: rebuild reconstructs a full blueprint from a posted form 42 let fb: *u8 = "title=New+T&brand=B2&hcta=Go&hhref=%2F&heroh=H2&herosub=S2&searcha=%2Fsearch&searchp=Find&card1t=C1&card1b=D1&step1=S1&sig1=G1&footer=F2" as *u8 43 var fn2: i64 = 0 44 while fb[fn2] != (0 as u8) { fn2 = fn2 + 1 } 45 let out: *u8 = sys_mmap(300000) 46 let ol: i64 = vb_rebuild(fb, fn2, out) 47 var t3: i64=0 48 if vg_has(out, ol, "title|New T\n" as *u8)==1 { if vg_has(out, ol, "hero|H2|S2\n" as *u8)==1 { if vg_has(out, ol, "card|C1|D1\n" as *u8)==1 { if vg_has(out, ol, "footer|F2\n" as *u8)==1 { t3=1 } } } } 49 // T4: urldecoding (+ -> space above; %26 -> &) 50 let fb4: *u8 = "title=A%26B+C&heroh=H&card1t=X&footer=F" as *u8 51 var f4n: i64 = 0 52 while fb4[f4n] != (0 as u8) { f4n = f4n + 1 } 53 let o4l: i64 = vb_rebuild(fb4, f4n, out) 54 var t4: i64=0 55 if vg_has(out, o4l, "title|A&B C\n" as *u8)==1 { t4=1 } 56 // T5: blank cards omitted -- exactly ONE card| line when only card1 is filled 57 if vg_count(out, o4l, "card|" as *u8)==1 { t4=t4 } // (count checked in t5 below on the same rebuild) 58 var t5: i64=0 59 if vg_count(out, o4l, "card|" as *u8)==1 { t5=1 } 60 // T6 (NEG): no title field -> the rebuilt blueprint LACKS title| (the daemon's validator refuses it) 61 let fb6: *u8 = "heroh=H&card1t=X&footer=F" as *u8 62 var f6n: i64 = 0 63 while fb6[f6n] != (0 as u8) { f6n = f6n + 1 } 64 let o6l: i64 = vb_rebuild(fb6, f6n, out) 65 var t6: i64=0 66 if vg_has(out, o6l, "title|" as *u8)==0 { if vg_has(out, o6l, "hero|H" as *u8)==1 { t6=1 } } 67 // T7 (NEG): format injection blocked -- a %7C ('|') inside a value becomes a space, never a field split 68 let fb7: *u8 = "title=T&heroh=H&card1t=A%7CB&card1b=D&footer=F" as *u8 69 var f7n: i64 = 0 70 while fb7[f7n] != (0 as u8) { f7n = f7n + 1 } 71 let o7l: i64 = vb_rebuild(fb7, f7n, out) 72 var t7: i64=0 73 if vg_has(out, o7l, "card|A B|D\n" as *u8)==1 { if vg_has(out, o7l, "card|A|B|" as *u8)==0 { t7=1 } } 74 75 var passes: i64=0 76 if t1==1 { passes=passes+1 } if t2==1 { passes=passes+1 } if t3==1 { passes=passes+1 } 77 if t4==1 { passes=passes+1 } if t5==1 { passes=passes+1 } if t6==1 { passes=passes+1 } if t7==1 { passes=passes+1 } 78 var green: i64=0; if passes==7 { green=1 } 79 80 gw("=== nx_cms_visual_builder_gate -- R-CANVAS v1 visual no-JS editor ===\n" as *u8) 81 vg_row("T1-form-prefills-from-blueprint" as *u8, t1) 82 vg_row("T2-attribute-escaping " as *u8, t2) 83 vg_row("T3-rebuild-full-blueprint " as *u8, t3) 84 vg_row("T4-urldecode-plus-and-pct " as *u8, t4) 85 vg_row("T5-blank-cards-omitted " as *u8, t5) 86 vg_row("T6-missing-title-refusable(neg)" as *u8, t6) 87 vg_row("T7-pipe-injection-blocked(neg) " as *u8, t7) 88 gw("verdict=" as *u8); if green==1 { gw("GREEN" as *u8) } else { gw("RED" as *u8) } 89 gw(" passes=" as *u8); gn(passes); gw("/7\n" as *u8) 90 91 let lg: i64 = sys_openat_append("knowledge/status/cms_visual_builder.log" as *u8, 0x1a4) 92 if lg >= 0 { 93 if green==1 { let m: *u8 = "CMS-VISUAL rows=7 pass=7 verdict=GREEN\n" as *u8; sys_write(lg, m, 39) } 94 else { let m2: *u8 = "CMS-VISUAL verdict=RED\n" as *u8; sys_write(lg, m2, 23) } 95 sys_close(lg) 96 } 97 if green==1 { return 0 } 98 return 1 99}