code wiki / _hdl_build / nx_cms_visual_builder_gate.nx
nx_cms_visual_builder_gate.nx source
↩ module page · 99 lines · 5670 B
1// nx_cms_visual_builder_gate.nx -- referee for R-CANVAS v1 (nx_cms_visual_builder): the visual no-JS site
2// editor lib. Proves: the form prefills from a real blueprint (attribute-escaped), the server-side rebuild
3// reconstructs a valid blueprint from posted urlencoded fields (decoded, blank cards omitted), and the
4// format cannot be injected ('|' in a value neutralized; missing title -> a blueprint the daemon's validator
5// refuses). GREEN iff 7/7. license_tier: ORIGINAL expect_exit: 0
6import "nx_gate.nx"
7import "nx_cms_visual_builder.nx"
8
9func vg_has(hay: *u8, hn: i64, needle: *u8) -> i64 {
10 if (hay as i64)==0 { return 0 }
11 var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1}
12 if nl==0 { return 1 }
13 var i: i64=0
14 while i+nl<=hn { var j: i64=0; var ok: i64=1; while j<nl { if (hay[i+j] as i64)!=(needle[j] as i64) { ok=0; j=nl } else { j=j+1 } } if ok==1 { return 1 } i=i+1 }
15 return 0
16}
17func vg_count(hay: *u8, hn: i64, needle: *u8) -> i64 {
18 if (hay as i64)==0 { return 0 }
19 var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1}
20 if nl==0 { return 0 }
21 var c: i64=0
22 var i: i64=0
23 while i+nl<=hn { var j: i64=0; var ok: i64=1; while j<nl { if (hay[i+j] as i64)!=(needle[j] as i64) { ok=0; j=nl } else { j=j+1 } } if ok==1 { c=c+1; i=i+nl } else { i=i+1 } }
24 return c
25}
26func vg_row(name: *u8, ok: i64) -> i64 { gw(" " as *u8); gw(name); if ok==1 { gw(" PASS\n" as *u8) } else { gw(" FAIL\n" as *u8) } return 0 }
27
28func main() -> i64 {
29 // fixture blueprint (a quote in a card body exercises attribute escaping)
30 let cfg: *u8 = "title|Old Title\nheader|Brand|Call now|/\nhero|Big H|Sub S\nsearch|/search|Find\ncard|Card One|We say \"hello\" here\ncard|Card Two|Second body\nstep|Step A\nsig|Trusted\nfooter|F text\n" as *u8
31 var cn: i64 = 0
32 while cfg[cn] != (0 as u8) { cn = cn + 1 }
33 let body: *u8 = sys_mmap(300000)
34 let bl: i64 = vb_form_page(cfg, cn, "TOK" as *u8, 3, body, 0)
35 // T1: prefilled fields (hero, card 1 name, footer) land as input values
36 var t1: i64=0
37 if vg_has(body, bl, "value=\"Big H\"" as *u8)==1 { if vg_has(body, bl, "value=\"Card One\"" as *u8)==1 { if vg_has(body, bl, "value=\"F text\"" as *u8)==1 { t1=1 } } }
38 // T2: attribute escaping -- the quoted card body renders "
39 var t2: i64=0
40 if vg_has(body, bl, "We say "hello" here" as *u8)==1 { t2=1 }
41 // T3: rebuild reconstructs a full blueprint from a posted form
42 let fb: *u8 = "title=New+T&brand=B2&hcta=Go&hhref=%2F&heroh=H2&herosub=S2&searcha=%2Fsearch&searchp=Find&card1t=C1&card1b=D1&step1=S1&sig1=G1&footer=F2" as *u8
43 var fn2: i64 = 0
44 while fb[fn2] != (0 as u8) { fn2 = fn2 + 1 }
45 let out: *u8 = sys_mmap(300000)
46 let ol: i64 = vb_rebuild(fb, fn2, out)
47 var t3: i64=0
48 if vg_has(out, ol, "title|New T\n" as *u8)==1 { if vg_has(out, ol, "hero|H2|S2\n" as *u8)==1 { if vg_has(out, ol, "card|C1|D1\n" as *u8)==1 { if vg_has(out, ol, "footer|F2\n" as *u8)==1 { t3=1 } } } }
49 // T4: urldecoding (+ -> space above; %26 -> &)
50 let fb4: *u8 = "title=A%26B+C&heroh=H&card1t=X&footer=F" as *u8
51 var f4n: i64 = 0
52 while fb4[f4n] != (0 as u8) { f4n = f4n + 1 }
53 let o4l: i64 = vb_rebuild(fb4, f4n, out)
54 var t4: i64=0
55 if vg_has(out, o4l, "title|A&B C\n" as *u8)==1 { t4=1 }
56 // T5: blank cards omitted -- exactly ONE card| line when only card1 is filled
57 if vg_count(out, o4l, "card|" as *u8)==1 { t4=t4 } // (count checked in t5 below on the same rebuild)
58 var t5: i64=0
59 if vg_count(out, o4l, "card|" as *u8)==1 { t5=1 }
60 // T6 (NEG): no title field -> the rebuilt blueprint LACKS title| (the daemon's validator refuses it)
61 let fb6: *u8 = "heroh=H&card1t=X&footer=F" as *u8
62 var f6n: i64 = 0
63 while fb6[f6n] != (0 as u8) { f6n = f6n + 1 }
64 let o6l: i64 = vb_rebuild(fb6, f6n, out)
65 var t6: i64=0
66 if vg_has(out, o6l, "title|" as *u8)==0 { if vg_has(out, o6l, "hero|H" as *u8)==1 { t6=1 } }
67 // T7 (NEG): format injection blocked -- a %7C ('|') inside a value becomes a space, never a field split
68 let fb7: *u8 = "title=T&heroh=H&card1t=A%7CB&card1b=D&footer=F" as *u8
69 var f7n: i64 = 0
70 while fb7[f7n] != (0 as u8) { f7n = f7n + 1 }
71 let o7l: i64 = vb_rebuild(fb7, f7n, out)
72 var t7: i64=0
73 if vg_has(out, o7l, "card|A B|D\n" as *u8)==1 { if vg_has(out, o7l, "card|A|B|" as *u8)==0 { t7=1 } }
74
75 var passes: i64=0
76 if t1==1 { passes=passes+1 } if t2==1 { passes=passes+1 } if t3==1 { passes=passes+1 }
77 if t4==1 { passes=passes+1 } if t5==1 { passes=passes+1 } if t6==1 { passes=passes+1 } if t7==1 { passes=passes+1 }
78 var green: i64=0; if passes==7 { green=1 }
79
80 gw("=== nx_cms_visual_builder_gate -- R-CANVAS v1 visual no-JS editor ===\n" as *u8)
81 vg_row("T1-form-prefills-from-blueprint" as *u8, t1)
82 vg_row("T2-attribute-escaping " as *u8, t2)
83 vg_row("T3-rebuild-full-blueprint " as *u8, t3)
84 vg_row("T4-urldecode-plus-and-pct " as *u8, t4)
85 vg_row("T5-blank-cards-omitted " as *u8, t5)
86 vg_row("T6-missing-title-refusable(neg)" as *u8, t6)
87 vg_row("T7-pipe-injection-blocked(neg) " as *u8, t7)
88 gw("verdict=" as *u8); if green==1 { gw("GREEN" as *u8) } else { gw("RED" as *u8) }
89 gw(" passes=" as *u8); gn(passes); gw("/7\n" as *u8)
90
91 let lg: i64 = sys_openat_append("knowledge/status/cms_visual_builder.log" as *u8, 0x1a4)
92 if lg >= 0 {
93 if green==1 { let m: *u8 = "CMS-VISUAL rows=7 pass=7 verdict=GREEN\n" as *u8; sys_write(lg, m, 39) }
94 else { let m2: *u8 = "CMS-VISUAL verdict=RED\n" as *u8; sys_write(lg, m2, 23) }
95 sys_close(lg)
96 }
97 if green==1 { return 0 }
98 return 1
99}