nx_meet_http_gate.nx source

1// nx_meet_http_gate.nx -- liar-kill gate for P2's live-route brain. Feeds fixture HTTP requests through 2// meet_http_handle and asserts: a clean apply POST is parsed + url-decoded + SCREENED + persisted (200 + thanks), 3// a honeypot-filled POST and an AI-slop POST are FLAGGED, a /request-talent POST routes to hire + SCREENED, a GET 4// is refused (405), and a %0D%0A URL-encoded CRLF injection is stripped in the PERSISTED record. expect_exit: 0 5import "nx_syscalls.nx" 6import "nx_meet_lib.nx" 7import "nx_meet_curate.nx" 8import "nx_meet_http.nx" 9import "nx_meet_store.nx" 10 11func has(hay: *u8, n: i64, needle: *u8) -> i64 { 12 let nl: i64 = mlen(needle); if nl == 0 { return 0 } 13 var i: i64 = 0 14 while i + nl <= n { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {return 1} i=i+1 } 15 return 0 16} 17func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 18// 1 if the persisted record for id contains needle. 19func stored_has(id: *u8, needle: *u8) -> i64 { 20 let pq: *i64 = sys_mmap(16) as *i64 21 let lq: *i64 = sys_mmap(16) as *i64 22 if meet_store_get(id, pq, lq) != 1 { return 0 } 23 return has(pq[0] as *u8, lq[0], needle) 24} 25 26func main() -> i64 { 27 mputs("=== nx_meet_http_gate: live-route handler (parse -> urldecode -> screen -> persist -> respond) ===\n" as *u8) 28 29 let clean: *u8 = "POST /apply HTTP/1.1\r\nHost: meet\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nname=Jane+Doe&email=jane%40example.com&role=Engineer&location=McKinney&resume=Built+payment+service+12000+reqs+jane%40example.com+github&website=&attest=on" as *u8 30 let bot: *u8 = "POST /apply HTTP/1.1\r\nHost: meet\r\n\r\nname=Spammer&email=s%40x.com&resume=Built+12000+jane%40example.com+github&website=http%3A%2F%2Fspam.example" as *u8 31 let slop: *u8 = "POST /apply HTTP/1.1\r\nHost: meet\r\n\r\nname=Bot&email=b%40x.com&resume=As+an+AI+language+model+results-driven+professional+synergy+proven+track+record+detail-oriented&website=" as *u8 32 let hire: *u8 = "POST /request-talent HTTP/1.1\r\nHost: meet\r\n\r\nname=HR&company=Acme+Inc&email=hr%40acme.com&role=Engineer&details=Senior+engineer+at+Acme+https%3A%2F%2Facme.com+salary+150000&website=" as *u8 33 let get: *u8 = "GET /apply HTTP/1.1\r\nHost: meet\r\n\r\n" as *u8 34 let inj: *u8 = "POST /apply HTTP/1.1\r\nHost: meet\r\n\r\nname=Eve%0D%0ABcc:+evil&email=eve%40x.com&resume=Built+12000+jane%40example.com+github&website=" as *u8 35 36 let resp: *u8 = sys_mmap(16384) 37 var pass: i64 = 0; var fail: i64 = 0 38 39 // 1) CLEAN apply 40 let v1: i64 = meet_http_handle(clean, slen(clean), "http-clean" as *u8, resp) 41 if v1 == ST_SCREENED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-not-screened\n" as *u8) } 42 if has(resp, slen(resp), "200 OK" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-no-200\n" as *u8) } 43 if has(resp, slen(resp), "Thanks" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-no-thanks\n" as *u8) } 44 if stored_has("http-clean" as *u8, "status: SCREENED" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL clean-status-not-persisted\n" as *u8) } 45 // url-decode teeth: + -> space, %40 -> @ 46 if stored_has("http-clean" as *u8, "name: Jane Doe" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL name-not-urldecoded\n" as *u8) } 47 if stored_has("http-clean" as *u8, "email: jane@example.com" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL email-not-urldecoded\n" as *u8) } 48 49 // 2) GET -> 405 50 let vg: i64 = meet_http_handle(get, slen(get), "http-get" as *u8, resp) 51 if vg == 0 - 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL get-not-refused\n" as *u8) } 52 if has(resp, slen(resp), "405" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL get-no-405\n" as *u8) } 53 54 // 3) honeypot bot -> FLAGGED 55 if meet_http_handle(bot, slen(bot), "http-bot" as *u8, resp) == ST_FLAGGED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL bot-not-flagged\n" as *u8) } 56 // 4) AI-slop -> FLAGGED 57 if meet_http_handle(slop, slen(slop), "http-slop" as *u8, resp) == ST_FLAGGED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL slop-not-flagged\n" as *u8) } 58 // 5) hire route -> SCREENED + persisted kind:hire 59 if meet_http_handle(hire, slen(hire), "http-hire" as *u8, resp) == ST_SCREENED { pass=pass+1 } else { fail=fail+1; mputs(" FAIL hire-not-screened\n" as *u8) } 60 if stored_has("http-hire" as *u8, "kind: hire" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL hire-kind-not-persisted\n" as *u8) } 61 // 6) URL-encoded CRLF injection -> stripped in the persisted record 62 meet_http_handle(inj, slen(inj), "http-inj" as *u8, resp) 63 if stored_has("http-inj" as *u8, "name: EveBcc: evil" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; mputs(" FAIL injection-not-stripped\n" as *u8) } 64 65 mputs("MEET-HTTP-GATE pass=" as *u8); mnum(pass); mputs(" fail=" as *u8); mnum(fail) 66 if fail == 0 { mputs(" verdict=GREEN (live-route handler: HTTP+form parse, url-decode, screen, persist, respond; injection-safe)\n" as *u8); sys_exit(0); return 0 } 67 mputs(" verdict=RED\n" as *u8); sys_exit(1); return 1 68}