code wiki / (root) / nx_grab_ext_emit_gate.nx
`nx_grab_ext_emit_gate.nx` source

↩ module page · 266 lines · 13607 B
1// nx_grab_ext_emit_gate.nx -- REFEREE for nx_grab_ext_emit (/compare/mediaingest R10 ge_emit).
2//
3// IN-PROCESS AND NETWORK-FREE. It imports the emitter and calls its pure functions against a PLANTED
4// conf image held in memory, so nothing is written to disk, no browser is involved, and the production
5// knowledge/grab_ext.conf is never read or touched by this gate.
6//
7// THE LOAD-BEARING TOOTH IS THE MV2/MV3 STRUCTURAL SPLIT. The whole reason both twins are emitted from
8// one conf is that they must differ in STRUCTURE and never in POLICY:
9//   MV2: background.scripts, browser_action, and <all_urls> INSIDE permissions
10//   MV3: background.service_worker, action, and <all_urls> moved OUT to host_permissions
11// A wrong split is the defect that ships a Chrome extension the store rejects, or a Firefox one whose
12// host access silently does nothing. Testing that both manifests merely "contain the name" would pass
13// on a broken split, so the teeth below check the permissions array CONTENTS on each side, in both
14// directions -- present where it belongs and ABSENT where it does not.
15// license_tier: ORIGINAL
16import "nx_syscalls.nx"
17import "nx_grab_ext_emit.nx"
18import "nx_gate_verdict.nx"
19
20const T_CAP:  i64 = 262144
21const T_SMALL: i64 = 4096
22
23// A planted conf: two comment lines (one of which contains a pipe, to prove comments are skipped and not
24// parsed as rows), one repeated key with three values, and every key the emitter needs.
25const T_CONF: *u8 = "# comment|not_a_row\nname|Test Grab\nversion|9.9\ndescription|planted\ngecko_id|t@nishi.local\nedge|https://edge.invalid\ncapture_path|/api/vault/capture\nmagnet_path|/t/m\nvideo_path|/t/v\nsession_header|X-Nishi-Session\nsession_key|nsess\nmedia_ext|m3u8\nmedia_ext|mp4\nmedia_ext|webm\nperm|webRequest\nperm|storage\nhost_perm|<all_urls>\n# trailing comment\n"
26
27// The same conf with the edge downgraded -- the neg-control for the https refusal.
28const T_CONF_HTTP: *u8 = "name|X\nversion|1\ndescription|d\ngecko_id|g\nedge|http://edge.invalid\ncapture_path|/c\nsession_header|H\nsession_key|k\nmedia_ext|mp4\nperm|storage\nhost_perm|<all_urls>\n"
29
30// A conf with a host_perm and ZERO perm rows. Two consecutive loops feed the ONE MV2 permissions array,
31// so an emitter that keys its separator off the loop index rather than a wrote-counter emits a LEADING
32// comma here -- invalid JSON that a browser rejects at load with no hint which row caused it. This
33// fixture exists to make that failure reachable; without it the bug is invisible on any normal conf.
34const T_CONF_NOPERM: *u8 = "name|Y\nversion|1\ndescription|d\ngecko_id|g\nedge|https://e.invalid\ncapture_path|/c\nsession_header|H\nsession_key|k\nmedia_ext|mp4\nhost_perm|<all_urls>\n"
35
36func t_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
37
38func t_find(buf: *u8, n: i64, lit: *u8, from: i64) -> i64 {
  let ll: i64 = t_slen(lit)
  if ll <= 0 { return 0 - 1 }
  var i: i64 = from
  while i + ll <= n {
      var same: i64 = 1
      var j: i64 = 0
      while j < ll { if buf[i + j] != lit[j] { same = 0 } j = j + 1 }
      if same == 1 { return i }
      i = i + 1
  }
  return 0 - 1
50}
51
52func t_has(buf: *u8, n: i64, lit: *u8) -> i64 { if t_find(buf, n, lit, 0) >= 0 { return 1 } return 0 }
53
54// Extent of the JSON array that follows `key` -- from the '[' after the key to its matching ']'.
55// Returns the length and sets off_out[0]; -1 when the key or a closing bracket is absent.
56func t_array_of(buf: *u8, n: i64, key: *u8, off_out: *i64) -> i64 {
  off_out[0] = 0 - 1
  let k: i64 = t_find(buf, n, key, 0)
  if k < 0 { return 0 - 1 }
  // Separate cursor and exit FLAG: writing a sentinel into the cursor to break the loop destroys the
  // very position the caller needs, and the estate measured that defect four times in one day.
  var i: i64 = k
  var open: i64 = 0 - 1
  var scanning: i64 = 1
  while scanning == 1 {
      if i >= n { scanning = 0 }
      else {
          if buf[i] == (91 as u8) { open = i; scanning = 0 } else { i = i + 1 }
      }
  }
  if open < 0 { return 0 - 1 }
  var e: i64 = open
  var close: i64 = 0 - 1
  scanning = 1
  while scanning == 1 {
      if e >= n { scanning = 0 }
      else {
          if buf[e] == (93 as u8) { close = e; scanning = 0 } else { e = e + 1 }
      }
  }
  if close < 0 { return 0 - 1 }
  off_out[0] = open
  return close - open + 1
84}
85
86func main() -> i64 {
  gv_head("=== nx_grab_ext_emit_gate -- the extension is EMITTED FROM DATA, both twins (mediaingest R10) ===" as *u8)
  let c: *i64 = gv_ctr()
  let cn: i64 = t_slen(T_CONF)
  let off: *i64 = sys_mmap(16) as *i64
91
  // ---- ANTI-VACUITY FIRST: the planted conf must actually carry what every tooth below inspects,
  // so a fixture that lost its rows cannot make this gate pass by examining nothing.
  var fx: i64 = 0
  if gx_count(T_CONF, cn, "media_ext" as *u8) == 3 {
      if gx_count(T_CONF, cn, "perm" as *u8) == 2 {
          if gx_count(T_CONF, cn, "host_perm" as *u8) == 1 { fx = 1 }
      }
  }
  gv_check("fixture-reached-the-condition-conf-carries-3-media-2-perm-1-hostperm" as *u8, fx, c)
101
  // ---- conf reader ----
  let vl: i64 = gx_nth(T_CONF, cn, "version" as *u8, 0, off)
  var t: i64 = 0
  if vl == 3 { if T_CONF[off[0]] == (57 as u8) { t = 1 } }
  gv_check("conf-reads-a-single-value" as *u8, t, c)
107
  // A comment line containing a pipe must NOT be parsed as a row. If it were, this key would resolve.
  t = 0
  if gx_nth(T_CONF, cn, "# comment" as *u8, 0, off) < 0 { t = 1 }
  gv_check("neg-control-a-commented-line-with-a-pipe-is-not-a-row" as *u8, t, c)
112
  t = 0
  if gx_nth(T_CONF, cn, "no_such_key" as *u8, 0, off) < 0 { t = 1 }
  gv_check("neg-control-absent-key-returns-minus-one" as *u8, t, c)
116
  // repeated key, read by index
  let m0: i64 = gx_nth(T_CONF, cn, "media_ext" as *u8, 0, off)
  var o0: i64 = off[0]
  let m2: i64 = gx_nth(T_CONF, cn, "media_ext" as *u8, 2, off)
  var o2: i64 = off[0]
  t = 0
  if m0 == 4 { if m2 == 4 { if T_CONF[o0] == (109 as u8) { if T_CONF[o2] == (119 as u8) { t = 1 } } } }
  gv_check("repeated-key-is-read-by-index-first-and-third-differ" as *u8, t, c)
125
  // ---- the media alternation: ONE list, and it is what the emitted regex is built from ----
  let alt: *u8 = sys_mmap(T_SMALL)
  let al: i64 = gx_media_alt(T_CONF, cn, alt, T_SMALL)
  t = 0
  if al > 0 { if t_has(alt, al, "m3u8|mp4|webm" as *u8) == 1 { t = 1 } }
  gv_check("media-alternation-joins-every-conf-row-in-order" as *u8, t, c)
132
  // ---- MV2 ----
  let mv2: *u8 = sys_mmap(T_CAP)
  let n2: i64 = gx_emit_mv2(T_CONF, cn, mv2, T_CAP)
  t = 0
  if n2 > 0 { t = 1 }
  gv_check("mv2-manifest-emits" as *u8, t, c)
139
  t = 0
  if t_has(mv2, n2, "\"manifest_version\": 2" as *u8) == 1 { t = 1 }
  gv_check("mv2-declares-manifest-version-2" as *u8, t, c)
  t = 0
  if t_has(mv2, n2, "\"background\": { \"scripts\"" as *u8) == 1 { t = 1 }
  gv_check("mv2-uses-background-scripts" as *u8, t, c)
  t = 0
  if t_has(mv2, n2, "\"browser_action\"" as *u8) == 1 { t = 1 }
  gv_check("mv2-uses-browser-action" as *u8, t, c)
  t = 0
  if t_has(mv2, n2, "\"service_worker\"" as *u8) == 0 { t = 1 }
  gv_check("neg-control-mv2-does-NOT-use-a-service-worker" as *u8, t, c)
  t = 0
  if t_has(mv2, n2, "\"host_permissions\"" as *u8) == 0 { t = 1 }
  gv_check("neg-control-mv2-has-NO-host-permissions-key" as *u8, t, c)
155
  // THE SPLIT, MV2 SIDE: <all_urls> must be INSIDE the permissions array.
  let pl2: i64 = t_array_of(mv2, n2, "\"permissions\"" as *u8, off)
  t = 0
  if pl2 > 0 { if t_has(((mv2 as i64) + off[0]) as *u8, pl2, "<all_urls>" as *u8) == 1 { t = 1 } }
  gv_check("mv2-permissions-array-CARRIES-all-urls" as *u8, t, c)
161
  // ---- MV3 ----
  let mv3: *u8 = sys_mmap(T_CAP)
  let n3: i64 = gx_emit_mv3(T_CONF, cn, mv3, T_CAP)
  t = 0
  if n3 > 0 { t = 1 }
  gv_check("mv3-manifest-emits" as *u8, t, c)
  t = 0
  if t_has(mv3, n3, "\"manifest_version\": 3" as *u8) == 1 { t = 1 }
  gv_check("mv3-declares-manifest-version-3" as *u8, t, c)
  t = 0
  if t_has(mv3, n3, "\"service_worker\": \"background.js\"" as *u8) == 1 { t = 1 }
  gv_check("mv3-uses-a-background-service-worker" as *u8, t, c)
  t = 0
  if t_has(mv3, n3, "\"host_permissions\"" as *u8) == 1 { t = 1 }
  gv_check("mv3-declares-host-permissions" as *u8, t, c)
  t = 0
  if t_has(mv3, n3, "\"browser_action\"" as *u8) == 0 { t = 1 }
  gv_check("neg-control-mv3-does-NOT-use-browser-action" as *u8, t, c)
180
  // THE SPLIT, MV3 SIDE -- the tooth that a broken emitter fails. <all_urls> must have MOVED OUT of
  // permissions and into host_permissions. Checking only that host_permissions exists would pass on an
  // emitter that wrote <all_urls> into BOTH, which is exactly the MV3 packaging error.
  let pl3: i64 = t_array_of(mv3, n3, "\"permissions\"" as *u8, off)
  t = 0
  if pl3 > 0 { if t_has(((mv3 as i64) + off[0]) as *u8, pl3, "<all_urls>" as *u8) == 0 { t = 1 } }
  gv_check("mv3-permissions-array-does-NOT-carry-all-urls-it-moved-to-host-permissions" as *u8, t, c)
188
  let hl3: i64 = t_array_of(mv3, n3, "\"host_permissions\"" as *u8, off)
  t = 0
  if hl3 > 0 { if t_has(((mv3 as i64) + off[0]) as *u8, hl3, "<all_urls>" as *u8) == 1 { t = 1 } }
  gv_check("mv3-host-permissions-array-CARRIES-all-urls" as *u8, t, c)
193
  // ---- the empty-perm array: no leading comma on either twin ----
  let en0: i64 = t_slen(T_CONF_NOPERM)
  let mv2b: *u8 = sys_mmap(T_CAP)
  let n2b: i64 = gx_emit_mv2(T_CONF_NOPERM, en0, mv2b, T_CAP)
  t = 0
  if n2b > 0 {
      if t_has(mv2b, n2b, "[, " as *u8) == 0 { if t_has(mv2b, n2b, "<all_urls>" as *u8) == 1 { t = 1 } }
  }
  gv_check("neg-control-mv2-with-zero-perm-rows-emits-no-leading-comma-and-still-carries-the-host-perm" as *u8, t, c)
  let mv3b: *u8 = sys_mmap(T_CAP)
  let n3b: i64 = gx_emit_mv3(T_CONF_NOPERM, en0, mv3b, T_CAP)
  t = 0
  if n3b > 0 { if t_has(mv3b, n3b, "[, " as *u8) == 0 { t = 1 } }
  gv_check("neg-control-mv3-with-zero-perm-rows-emits-no-leading-comma" as *u8, t, c)
208
  // ---- POLICY IS IDENTICAL ACROSS TWINS even though STRUCTURE differs ----
  t = 0
  if t_has(mv2, n2, "\"name\": \"Test Grab\"" as *u8) == 1 {
      if t_has(mv3, n3, "\"name\": \"Test Grab\"" as *u8) == 1 { t = 1 }
  }
  gv_check("both-twins-carry-the-same-name-from-the-one-conf" as *u8, t, c)
  t = 0
  if t_has(mv2, n2, "\"version\": \"9.9\"" as *u8) == 1 {
      if t_has(mv3, n3, "\"version\": \"9.9\"" as *u8) == 1 { t = 1 }
  }
  gv_check("both-twins-carry-the-same-version-from-the-one-conf" as *u8, t, c)
220
  // ---- the emitted scripts ----
  let bg: *u8 = sys_mmap(T_CAP)
  let nb: i64 = gx_emit_bg(T_CONF, cn, bg, T_CAP)
  t = 0
  if nb > 0 { if t_has(bg, nb, "m3u8|mp4|webm" as *u8) == 1 { t = 1 } }
  gv_check("background-regex-is-built-from-the-conf-media-rows" as *u8, t, c)
  t = 0
  if t_has(bg, nb, "https://edge.invalid" as *u8) == 1 { t = 1 }
  gv_check("background-carries-the-conf-edge-host" as *u8, t, c)
  t = 0
  if t_has(bg, nb, "/api/vault/capture" as *u8) == 1 { t = 1 }
  gv_check("background-posts-to-the-capture-chokepoint-from-conf" as *u8, t, c)
  // R11: the whole point is that no native companion exists. If a future edit reaches for native
  // messaging, this tooth fails and the reviewer is told which promise was broken.
  t = 0
  if t_has(bg, nb, "connectNative" as *u8) == 0 {
      if t_has(bg, nb, "nativeMessaging" as *u8) == 0 { t = 1 }
  }
  gv_check("R11-neg-control-emitted-background-uses-NO-native-messaging-host" as *u8, t, c)
  // nx_cc forbids '!' inside a string literal, so the emitted JS must never contain one. A future edit
  // that reaches for it would fail to COMPILE, but this tooth says so in words rather than as a lexer error.
  t = 0
  if t_has(bg, nb, "===" as *u8) == 1 { t = 1 }
  gv_check("emitted-js-uses-explicit-equality-the-lexer-forbids-bang-in-a-literal" as *u8, t, c)
245
  let ct: *u8 = sys_mmap(T_CAP)
  let nc: i64 = gx_emit_content(T_CONF, cn, ct, T_CAP)
  t = 0
  if nc > 0 { if t_has(ct, nc, "location.origin === EDGE" as *u8) == 1 { t = 1 } }
  gv_check("content-script-harvests-the-session-ONLY-on-the-estate-origin" as *u8, t, c)
251
  // ---- the https refusal, tested as a PREDICATE (the emitter's own guard calls sys_exit, which a
  // gate cannot survive in-process; gx_starts is the decision that guard branches on) ----
  let en: i64 = t_slen(T_CONF_HTTP)
  let el: i64 = gx_nth(T_CONF_HTTP, en, "edge" as *u8, 0, off)
  t = 0
  if el > 0 { if gx_starts(T_CONF_HTTP, off[0], el, "https://" as *u8) == 0 { t = 1 } }
  gv_check("neg-control-an-http-edge-fails-the-https-predicate-the-emitter-refuses-on" as *u8, t, c)
  let el2: i64 = gx_nth(T_CONF, cn, "edge" as *u8, 0, off)
  t = 0
  if el2 > 0 { if gx_starts(T_CONF, off[0], el2, "https://" as *u8) == 1 { t = 1 } }
  gv_check("an-https-edge-passes-the-same-predicate" as *u8, t, c)
263
  return gv_verdict("nx_grab_ext_emit_gate" as *u8, c,
      "pure emitters against a planted in-memory conf -- nothing is written to disk, the production knowledge/grab_ext.conf is never read, and no browser is involved; a green here says the two manifests are structurally correct for their engines and that both twins carry one policy, and says NOTHING about whether either extension loads in a real browser, which is a separate declared step" as *u8)
266}
nx_grab_ext_emit_gate.nx source

`nx_grab_ext_emit_gate.nx` source
