code wiki / (root) / nx_html_render_test.nx
`nx_html_render_test.nx` source

↩ module page · 202 lines · 7742 B
1// nx_html_render_test.nx -- smoke + XSS-attack-vector tests.
2//
3// Exercises every context + every escape rule + the bounds-check
4// + the known-XSS attack-string corpus.
5//
6// expect_exit: 0
7//
8// license_tier: ORIGINAL
9
10import "nx_syscalls_x86_64.nx"
11import "nx_html_render.nx"
12
13func bytes_eq(a: *u8, b: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n {
      if a[i] != b[i] { return 0 }
      i = i + 1
  }
  return 1
20}
21
22// Helper: render `escape(src, ctx)` into a fresh buffer + verify it
23// matches expected.  Returns 0 on match, error-code-with-base on miss.
24func check_escape(src: *u8, src_n: i64, ctx: i64,
                  expected: *u8, expected_n: i64,
                  err_base: i64) -> i64 {
  let buf: *u8 = sys_mmap(1024)
  var off: i64 = 0
  let rc: i64 = nx_html_escape(buf, &off, 1024, src, src_n, ctx)
  if rc != NXH_OK { return err_base + 90 }
  if off != expected_n { return err_base + 91 }
  if bytes_eq(buf, expected, expected_n) != 1 { return err_base + 92 }
  return 0
34}
35
36func main() -> i64 {
  // ---- Context-enum validity gate ----
  if nxh_ctx_is_valid(NXH_CTX_TEXT) != 1 { return 1 }
  if nxh_ctx_is_valid(NXH_CTX_RAW) != 1 { return 2 }
  if nxh_ctx_is_valid(NXH_CTX_N) != 0 { return 3 }
  if nxh_ctx_is_valid(-1) != 0 { return 4 }
42
  if nxh_node_is_valid(NXH_NODE_ELEMENT) != 1 { return 5 }
  if nxh_node_is_valid(NXH_NODE_N) != 0 { return 6 }
  if nxh_verdict_is_valid(NXH_OK) != 1 { return 7 }
  if nxh_verdict_is_valid(NXH_VERDICT_N) != 0 { return 8 }
47
  // ---- TEXT context: < > & escape ----
  var rc: i64 = check_escape(
      "hello <world> & friends" as *u8, 23, NXH_CTX_TEXT,
      "hello &lt;world&gt; &amp; friends" as *u8, 33, 100)
  if rc != 0 { return rc }
53
  // ---- ATTR_DQ context: & < > " ----
  rc = check_escape(
      "a&b<c>d\"e" as *u8, 9, NXH_CTX_ATTR_DQ,
      "a&amp;b&lt;c&gt;d&quot;e" as *u8, 24, 200)
  if rc != 0 { return rc }
59
  // ---- ATTR_SQ context: & < > ' ----
  rc = check_escape(
      "a&b'c" as *u8, 5, NXH_CTX_ATTR_SQ,
      "a&amp;b&#x27;c" as *u8, 14, 300)
  if rc != 0 { return rc }
65
  // ---- URL context: %HH-encode unsafe bytes ----
  rc = check_escape(
      "hello world" as *u8, 11, NXH_CTX_URL,
      "hello%20world" as *u8, 13, 400)
  if rc != 0 { return rc }
71
  rc = check_escape(
      "a<b" as *u8, 3, NXH_CTX_URL,
      "a%3Cb" as *u8, 5, 410)
  if rc != 0 { return rc }
76
  // URL: safe punctuation (/ : ? = & #) passes through
  rc = check_escape(
      "http://x/y?a=b&c=d" as *u8, 18, NXH_CTX_URL,
      "http://x/y?a=b&c=d" as *u8, 18, 420)
  if rc != 0 { return rc }
82
  // ---- RAW context: verbatim copy (caller-asserted-safe) ----
  rc = check_escape(
      "<b>bold</b>" as *u8, 11, NXH_CTX_RAW,
      "<b>bold</b>" as *u8, 11, 500)
  if rc != 0 { return rc }
88
  // ---- COMMENT context: rejects `--` ----
  let buf: *u8 = sys_mmap(256)
  var off: i64 = 0
  let rc_c: i64 = nx_html_escape(buf, &off, 256,
      "ok -- bad" as *u8, 9, NXH_CTX_COMMENT)
  if rc_c != NXH_BAD_INPUT { return 600 }
95
  // COMMENT: clean text passes
  off = 0
  let rc_c2: i64 = nx_html_escape(buf, &off, 256,
      "all good" as *u8, 8, NXH_CTX_COMMENT)
  if rc_c2 != NXH_OK { return 610 }
  if off != 8 { return 611 }
102
  // ---- CDATA context: rejects `]]>` ----
  off = 0
  let rc_cd: i64 = nx_html_escape(buf, &off, 256,
      "ok ]]> bad" as *u8, 10, NXH_CTX_CDATA)
  if rc_cd != NXH_BAD_INPUT { return 700 }
108
  // ---- BAD_CTX path ----
  off = 0
  let rc_bc: i64 = nx_html_escape(buf, &off, 256,
      "x" as *u8, 1, 99)
  if rc_bc != NXH_BAD_CTX { return 800 }
114
  // ---- OOM_BUFFER path ----
  let small: *u8 = sys_mmap(4)
  off = 0
  let rc_oom: i64 = nx_html_escape(small, &off, 4,
      "abcdefghij" as *u8, 10, NXH_CTX_TEXT)
  if rc_oom != NXH_OOM_BUFFER { return 810 }
121
  // ---- Known XSS attack vectors -- all must be NEUTRALIZED ----
123
  // 1. <script>alert(1)</script> in TEXT context
  let xss1_src: *u8 = "<script>alert(1)</script>" as *u8
  let xss1_exp: *u8 = "&lt;script&gt;alert(1)&lt;/script&gt;" as *u8
  rc = check_escape(xss1_src, 25, NXH_CTX_TEXT, xss1_exp, 37, 900)
  if rc != 0 { return rc }
129
  // 2. attribute-breakout via " in ATTR_DQ
  let xss2_src: *u8 = "x\" onerror=alert(1) x=\"" as *u8
  let xss2_exp: *u8 = "x&quot; onerror=alert(1) x=&quot;" as *u8
  rc = check_escape(xss2_src, 23, NXH_CTX_ATTR_DQ, xss2_exp, 33, 1000)
  if rc != 0 { return rc }
135
  // 3. javascript:alert(1) -- URL escape encodes `(` and `)` as %28
  // %29, but the colon + alnum survive (URL context is permissive on
  // path punctuation).  Protection against javascript: scheme MUST
  // happen at scheme-allow-list layer (queued: nx_url_scheme_
  // allowlist).  nx_html_render's job is byte-level context escape.
  let xss3_src: *u8 = "javascript:alert(1)" as *u8
  let xss3_exp: *u8 = "javascript:alert%281%29" as *u8
  rc = check_escape(xss3_src, 19, NXH_CTX_URL, xss3_exp, 23, 1100)
  if rc != 0 { return rc }
145
  // 4. Open-tag injection in URL value: `<svg onload=...>` byte-encoded.
  let xss4_src: *u8 = "<svg onload=alert(1)>" as *u8
  // < -> %3C, space -> %20, > -> %3E, ( -> %28, ) -> %29
  let xss4_exp: *u8 = "%3Csvg%20onload=alert%281%29%3E" as *u8
  rc = check_escape(xss4_src, 21, NXH_CTX_URL, xss4_exp, 31, 1200)
  if rc != 0 { return rc }
152
  // 5. Single-quote breakout in ATTR_SQ
  let xss5_src: *u8 = "x' onerror='alert(1)" as *u8
  let xss5_exp: *u8 = "x&#x27; onerror=&#x27;alert(1)" as *u8
  rc = check_escape(xss5_src, 20, NXH_CTX_ATTR_SQ, xss5_exp, 30, 1300)
  if rc != 0 { return rc }
158
  // ---- Element-emission flow ----
  let ebuf: *u8 = sys_mmap(512)
  var eoff: i64 = 0
  if nx_html_open_tag(ebuf, &eoff, 512, "div" as *u8, 3) != NXH_OK { return 1400 }
  if nx_html_attr(ebuf, &eoff, 512,
                  "class" as *u8, 5,
                  "card x>y" as *u8, 8) != NXH_OK { return 1401 }
  if nx_html_close_open_tag(ebuf, &eoff, 512) != NXH_OK { return 1402 }
  if nx_html_text(ebuf, &eoff, 512, "hello <world>" as *u8, 13) != NXH_OK { return 1403 }
  if nx_html_end_tag(ebuf, &eoff, 512, "div" as *u8, 3) != NXH_OK { return 1404 }
169
  // Expected: <div class="card x&gt;y">hello &lt;world&gt;</div>
  let exp: *u8 = "<div class=\"card x&gt;y\">hello &lt;world&gt;</div>" as *u8
  if eoff != 50 { return 1410 }
  if bytes_eq(ebuf, exp, 50) != 1 { return 1411 }
174
  // ---- BAD_INPUT: invalid tag name ----
  eoff = 0
  if nx_html_open_tag(ebuf, &eoff, 512, "di<v" as *u8, 4) != NXH_BAD_INPUT { return 1500 }
178
  // BAD_INPUT: attribute name with quote
  eoff = 0
  if nx_html_open_tag(ebuf, &eoff, 512, "div" as *u8, 3) != NXH_OK { return 1510 }
  if nx_html_attr(ebuf, &eoff, 512,
                  "cls\"" as *u8, 4,
                  "x" as *u8, 1) != NXH_BAD_INPUT { return 1511 }
185
  // ---- URL-attr emission ----
  eoff = 0
  if nx_html_open_tag(ebuf, &eoff, 512, "a" as *u8, 1) != NXH_OK { return 1600 }
  if nx_html_attr_url(ebuf, &eoff, 512,
                        "href" as *u8, 4,
                        "/audit?ts=1" as *u8, 11) != NXH_OK { return 1601 }
  if nx_html_close_open_tag(ebuf, &eoff, 512) != NXH_OK { return 1602 }
  if nx_html_text(ebuf, &eoff, 512, "open" as *u8, 4) != NXH_OK { return 1603 }
  if nx_html_end_tag(ebuf, &eoff, 512, "a" as *u8, 1) != NXH_OK { return 1604 }
195
  // Expected: <a href="/audit?ts=1">open</a>
  let exp_a: *u8 = "<a href=\"/audit?ts=1\">open</a>" as *u8
  if eoff != 30 { return 1610 }
  if bytes_eq(ebuf, exp_a, 30) != 1 { return 1611 }
200
  return 0
202}
nx_html_render_test.nx source

`nx_html_render_test.nx` source
