code wiki / _hdl_build / nx_meal_page_gate.nx
`nx_meal_page_gate.nx` source

↩ module page · 157 lines · 9559 B
1// nx_meal_page_gate.nx -- proves the SHIPPED surface. Until this existed, kitchen.html was the one live artifact
2// in the chain proven only by me reading it, which is not proof.
3//
4// Four cells are BITE-PROVEN, and they are the four ways this page could tell a lie: claim a source it has not
5// preserved, run a hostile creative, post a form into the void, or let recipe text become markup.
6// license_tier: ORIGINAL   No hw writes (Rule 26).
7import "nx_syscalls.nx"
8import "nx_meal_page.nx"
9import "nx_gate_verdict.nx"
10
11const PG_PAGE: i64 = 262144
12const PG_WARC: i64 = 65536
13const PG_PFX: i64 = 200
14const PG_INV: i64 = 4096
15const PG_DAY: i64 = 20671
16const PG_SALE: i64 = 50
17
18func pg_has(buf: *u8, n: i64, lit: *u8) -> i64 {
  var ll: i64 = 0
  while lit[ll] != (0 as u8) { ll = ll + 1 }
  if ll == 0 { return 0 }
  var i: i64 = 0
  while i + ll <= n {
      var j: i64 = 0
      var ok: i64 = 1
      while j < ll { if buf[i+j] != lit[j] { ok = 0; j = ll } else { j = j + 1 } }
      if ok == 1 { return 1 }
      i = i + 1
  }
  return 0
31}
32
33func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_meal_page -- the shipped surface: does it ever claim more than it holds?" as *u8)
36
  let ep: i64 = sys_now_realtime_sec()
  let meal: *u8 = sys_mmap(PG_PFX)
  var o: i64 = as_append(meal, 0, "/tmp/mpg_m_" as *u8)
  o = fd_apnum(meal, o, ep); o = as_append(meal, o, "-" as *u8); meal[o] = 0 as u8
  let inv: *u8 = sys_mmap(PG_PFX)
  var i2: i64 = as_append(inv, 0, "/tmp/mpg_i_" as *u8)
  i2 = fd_apnum(inv, i2, ep); i2 = as_append(inv, i2, "-" as *u8); inv[i2] = 0 as u8
  let price: *u8 = sys_mmap(PG_PFX)
  var p2: i64 = as_append(price, 0, "/tmp/mpg_p_" as *u8)
  p2 = fd_apnum(price, p2, ep); p2 = as_append(price, p2, "-" as *u8); price[p2] = 0 as u8
47
  let url: *u8 = "https://example.org/recipes/stew" as *u8
49
  // a recipe whose TITLE is hostile markup -- recipe text is untrusted input like any other
  mp_add_recipe(meal, "stew" as *u8, "Beef <script>alert(1)</script> Stew" as *u8, "A braise & a <b>test</b>" as *u8, 6, "beef onion" as *u8)
  mp_add_recipe(meal, "nosrc" as *u8, "Unsourced Dish" as *u8, "No provenance at all" as *u8, 2, "beef onion" as *u8)
  mp_add_ingredient(meal, "beef" as *u8, "Beef chuck" as *u8)
  mp_add_ingredient(meal, "onion" as *u8, "Yellow onion" as *u8)
  mp_add_unit(meal, "u" as *u8, "Test Kitchen" as *u8, "family" as *u8, "u" as *u8, "area" as *u8)
  iv_add(inv, "u" as *u8, "onion" as *u8, "Yellow onion" as *u8, "produce" as *u8, 3, "each" as *u8, "pantry" as *u8, 90, 0, ed_empty())
  pr_add_store(price, "s1" as *u8, "Test Store" as *u8, "indie" as *u8, "area" as *u8, "WA" as *u8, "shelf tag" as *u8)
  pr_set_price(price, "s1" as *u8, "beef" as *u8, 999, "2026-08-06" as *u8, "lb" as *u8, "shelf tag" as *u8)
59
  // provenance + a real preserved copy for `stew`; NOTHING for `nosrc`
  let body: *u8 = sys_mmap(1024)
  var bl: i64 = as_append(body, 0, "<html><body>origin</body></html>" as *u8)
  let warc: *u8 = sys_mmap(PG_WARC)
  var wl: i64 = ms_capture(warc, 0, url, "2026-08-06T00:00:00Z" as *u8, "text/html" as *u8, body, bl)
  ms_record(meal, "stew" as *u8, "Beef Stew" as *u8, "Example Kitchen" as *u8, url, "CC BY-SA 3.0" as *u8, PG_DAY, bl)
66
  // a GOOD ad inventory and a HOSTILE one (javascript: click target)
  let good: *u8 = sys_mmap(PG_INV)
  var g: i64 = as_append(good, 0, "@host\tnishifamily.com\n" as *u8)
  g = as_append(good, g, "k1\tCascade Market\t/img/a.png\thttps://example.com/c\tkitchen\t5\n" as *u8)
  good[g] = 0 as u8
  let bad: *u8 = sys_mmap(PG_INV)
  var b: i64 = as_append(bad, 0, "@host\tnishifamily.com\n" as *u8)
  b = as_append(bad, b, "k2\tHostile Co\t/img/a.png\tjavascript:alert(1)\tkitchen\t5\n" as *u8)
  bad[b] = 0 as u8
76
  // TWO buffers on purpose. Every variant renders into `page`, but the canonical GOOD render gets its own
  // `refpage` that nothing overwrites. v1 of this gate reused one buffer and then compared the GOOD arm as
  // pg_has(refpage, n3, ...) AFTER later renders had clobbered it -- reading the hostile render's bytes with the
  // good render's length. gv_bite caught it as FALSE-POSITIVE rather than letting it pass quietly.
  let page: *u8 = sys_mmap(PG_PAGE)
  let refpage: *u8 = sys_mmap(PG_PAGE)
83
  // ---- T1 the full page renders with its structure intact ----
  let n1: i64 = mpg_render(page, meal, inv, price, "stew" as *u8, "u" as *u8, warc, wl, good, g, 0, PG_SALE, "kitchen" as *u8, "/kitchen/stew" as *u8, 1)
  var t1: i64 = 1
  if n1 < 8000 { t1 = 0 }
  if pg_has(page, n1, "<main class='wrap'>" as *u8) == 0 { t1 = 0 }
  if pg_has(page, n1, "class='mast-eyebrow'" as *u8) == 0 { t1 = 0 }
  if pg_has(page, n1, "prefers-color-scheme:dark" as *u8) == 0 { t1 = 0 }
  if pg_has(page, n1, "data-theme='dark'" as *u8) == 0 { t1 = 0 }
  if pg_has(page, n1, "What this costs you today" as *u8) == 0 { t1 = 0 }
  gv_check("T1 page renders with the main landmark, masthead, and BOTH theme paths" as *u8, t1, ctr)
94
  // ---- T2 ZERO-JS: a sovereign page ships no script, ever ----
  var t2: i64 = 1
  if pg_has(page, n1, "<script" as *u8) == 1 { t2 = 0 }
  if pg_has(page, n1, "onclick" as *u8) == 1 { t2 = 0 }
  if pg_has(page, n1, "javascript:" as *u8) == 1 { t2 = 0 }
  gv_check("T2 no <script>, no inline handler, no javascript: URL anywhere in the emitted page" as *u8, t2, ctr)
101
  // ---- T3 BITE: recipe text can never become markup ----
  var esc_bad: i64 = 0
  if pg_has(page, n1, "&lt;script&gt;" as *u8) == 1 { esc_bad = 1 }        // it escaped the hostile title
  var esc_good: i64 = 0
  if pg_has(page, n1, "alert(1)</script>" as *u8) == 1 { esc_good = 1 }    // raw markup must NOT appear
  gv_bite("T3 hostile recipe title is escaped, and the raw script tag never reaches the page" as *u8, esc_bad, esc_good, ctr)
108
  // ---- T4 BITE: the credit strip only exists when a source does ----
  let n2: i64 = mpg_render(page, meal, inv, price, "nosrc" as *u8, "u" as *u8, warc, wl, good, g, 0, PG_SALE, "kitchen" as *u8, "/k" as *u8, 1)
  var cred_bad: i64 = 0
  if pg_has(page, n2, "Brought to you by" as *u8) == 0 { cred_bad = 1 }     // unsourced -> strip OMITTED
  let n3: i64 = mpg_render(refpage, meal, inv, price, "stew" as *u8, "u" as *u8, warc, wl, good, g, 0, PG_SALE, "kitchen" as *u8, "/k" as *u8, 1)
  var cred_good: i64 = 0
  if pg_has(refpage, n3, "Brought to you by" as *u8) == 0 { cred_good = 1 }    // sourced -> strip PRESENT
  gv_bite("T4 brought-to-you-by is omitted for the unsourced dish and present for the sourced one" as *u8, cred_bad, cred_good, ctr)
117
  // ---- T5 the archived-copy claim tracks the bytes, not a flag ----
  var t5: i64 = 1
  if pg_has(refpage, n3, "Archived copy held" as *u8) == 0 { t5 = 0 }
  let empty_warc: *u8 = sys_mmap(64)
  let n4: i64 = mpg_render(page, meal, inv, price, "stew" as *u8, "u" as *u8, empty_warc, 0, good, g, 0, PG_SALE, "kitchen" as *u8, "/k" as *u8, 1)
  if pg_has(page, n4, "Archived copy held" as *u8) == 1 { t5 = 0 }          // same record, no bytes -> no claim
  if pg_has(page, n4, "this link can rot" as *u8) == 0 { t5 = 0 }
  gv_check("T5 with the SAME provenance row but an empty archive, the page says the link can rot" as *u8, t5, ctr)
126
  // ---- T6 BITE: a hostile creative is refused by the estate's own validators ----
  let n5: i64 = mpg_render(page, meal, inv, price, "stew" as *u8, "u" as *u8, warc, wl, bad, b, 0, PG_SALE, "kitchen" as *u8, "/k" as *u8, 1)
  var ad_bad: i64 = 0
  if pg_has(page, n5, "Session sponsored by" as *u8) == 0 { ad_bad = 1 }     // javascript: click -> slot OMITTED
  var ad_good: i64 = 0
  if pg_has(refpage, n3, "Session sponsored by" as *u8) == 0 { ad_good = 1 }    // valid creative -> slot PRESENT
  gv_bite("T6 sponsor slot refuses a javascript: click target and still runs the valid creative" as *u8, ad_bad, ad_good, ctr)
134
  // ---- T7 BITE: no form unless something is listening ----
  let n6: i64 = mpg_render(page, meal, inv, price, "stew" as *u8, "u" as *u8, warc, wl, good, g, 0, PG_SALE, "kitchen" as *u8, "/k" as *u8, 0)
  var form_bad: i64 = 0
  if pg_has(page, n6, "<form" as *u8) == 0 { form_bad = 1 }                  // intake down -> NO form at all
  var form_good: i64 = 0
  if pg_has(refpage, n3, "<form" as *u8) == 0 { form_good = 1 }                 // intake up -> forms render
  var t7b: i64 = 1
  if pg_has(page, n6, "not open yet" as *u8) == 0 { t7b = 0 }                // and it SAYS so
  gv_bite("T7a forms disappear when the intake is down and return when it is up" as *u8, form_bad, form_good, ctr)
  gv_check("T7b with no intake the page states the note box is not open, rather than posting into the void" as *u8, t7b, ctr)
145
  // ---- T8 the honeypot ships with the form, invisible and untabbable ----
  var t8: i64 = 1
  if pg_has(refpage, n3, "name='website'" as *u8) == 0 { t8 = 0 }
  if pg_has(refpage, n3, "tabindex='-1'" as *u8) == 0 { t8 = 0 }
  if pg_has(refpage, n3, "aria-hidden='true'" as *u8) == 0 { t8 = 0 }
  if pg_has(refpage, n3, "maxlength='1000'" as *u8) == 0 { t8 = 0 }
  gv_check("T8 the spam trap ships with every form: hidden, untabbable, aria-hidden, body capped" as *u8, t8, ctr)
153
  let rc: i64 = gv_verdict("MEAL-PAGE" as *u8, ctr, "the surface omits what it cannot back: no source, no strip; no bytes, no archive claim; no listener, no form" as *u8)
  sys_exit(rc)
  return 0
157}
nx_meal_page_gate.nx source

`nx_meal_page_gate.nx` source
