nx_sitegen_video_gate.nx source

1// nx_sitegen_video_gate.nx -- gate for the VIDEO-GALLERY page type (nx_sitegen_video). Proves a YouTube-for-pets 2// page builds from data: every video's title/thumbnail/source renders, the inline player + responsive grid + 3// onsite search are present, a malicious title is injection-ESCAPED, a 2nd different gallery is genuinely 4// different (data-driven, not one-off), and the same data builds byte-identical (reproducible). Positive AND 5// negative controls. Appends "CMSGATE row=nx_sitegen_video site-builder-video ... verdict=PASS" to 6// knowledge/status/cms_gate.log on all-pass. license_tier: ORIGINAL 7import "nx_sitegen_video.nx" 8import "nx_syscalls.nx" 9 10func vg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 11func vg_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 12func vg_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o } 13func vg_catnum(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o } 14func vg_row(id: i64, ok: i64, what: *u8) -> i64 { vg_w("VGROW " as *u8); vg_num(id); vg_w(" " as *u8); if ok==1 { vg_w("PASS " as *u8) } else { vg_w("FAIL " as *u8) } vg_w(what); vg_w("\n" as *u8); return ok } 15func vg_slurp(path: *u8, buf: *u8, cap: i64) -> i64 { 16 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 - 1 } 17 var total: i64 = 0; var go: i64 = 1 18 while go == 1 { let r: i64 = sys_read(fd, buf + total, cap - total); if r <= 0 { go = 0 } if r > 0 { total = total + r } if total >= cap { go = 0 } } 19 sys_close(fd); return total 20} 21func vg_has(hay: *u8, hn: i64, needle: *u8) -> i64 { 22 var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1} 23 if nl==0 { return 1 } if nl>hn { return 0 } 24 let last: i64=hn-nl; var i: i64=0 25 while i<=last { var j: i64=0; var hit: i64=1; while j<nl { if (hay[i+j] as i64)!=(needle[j] as i64){hit=0;j=nl} if hit==1{j=j+1} } if hit==1 { return 1 } i=i+1 } 26 return 0 27} 28func vg_eq(a: *u8, an: i64, b: *u8, bn: i64) -> i64 { if an!=bn { return 0 } var i: i64=0; while i<an { if (a[i] as i64)!=(b[i] as i64){return 0} i=i+1 } return 1 } 29func vg_build_file(path: *u8, title: *u8, heading: *u8, t: *i64, th: *i64, u: *i64, n: i64, buf: *u8, cap: i64) -> i64 { 30 let fd: i64 = sys_openat_wr(path, 0x1a4) 31 if fd >= 0 { vid_build(fd, title, heading, t, th, u, n); sys_close(fd) } 32 return vg_slurp(path, buf, cap) 33} 34 35func main() -> i64 { 36 // the pets gallery (data) 37 let t: *i64 = sys_mmap(8*8) as *i64 38 let th: *i64 = sys_mmap(8*8) as *i64 39 let u: *i64 = sys_mmap(8*8) as *i64 40 t[0]="Whiskers naps in the sun" as *u8 as i64; th[0]="/thumbs/whiskers.jpg" as *u8 as i64; u[0]="/vids/whiskers.mp4" as *u8 as i64 41 t[1]="Rex fetches the ball" as *u8 as i64; th[1]="/thumbs/rex.jpg" as *u8 as i64; u[1]="/vids/rex.mp4" as *u8 as i64 42 t[2]="Goldie swims laps" as *u8 as i64; th[2]="/thumbs/goldie.jpg" as *u8 as i64; u[2]="/vids/goldie.mp4" as *u8 as i64 43 44 let buf1: *u8 = sys_mmap(262144) 45 let n1: i64 = vg_build_file("/tmp/nx_video_pets.html" as *u8, "Nishi Pets -- watch our family pets" as *u8, "Latest pet videos" as *u8, t, th, u, 3, buf1, 262143) 46 47 var pass: i64 = 0 48 var rows: i64 = 0 49 var ok: i64 = 0 50 51 // R0: built + 3 videos 52 let len1: i64 = vg_slurp("/tmp/nx_video_pets.html" as *u8, buf1, 262143) 53 ok = 0; if n1 > 0 { if len1 > 0 { ok = 1 } } 54 rows=rows+1; pass=pass+vg_row(0, ok, "video gallery builds from data, non-empty (3 videos proven in R1/R2)" as *u8) 55 56 // R1: every video title rendered 57 ok = 0; if vg_has(buf1,len1,"Whiskers naps in the sun" as *u8)==1 { if vg_has(buf1,len1,"Rex fetches the ball" as *u8)==1 { if vg_has(buf1,len1,"Goldie swims laps" as *u8)==1 { ok=1 } } } 58 rows=rows+1; pass=pass+vg_row(1, ok, "all 3 video titles rendered (list walked from data)" as *u8) 59 60 // R2: every video source rendered 61 ok = 0; if vg_has(buf1,len1,"/vids/whiskers.mp4" as *u8)==1 { if vg_has(buf1,len1,"/vids/rex.mp4" as *u8)==1 { if vg_has(buf1,len1,"/vids/goldie.mp4" as *u8)==1 { ok=1 } } } 62 rows=rows+1; pass=pass+vg_row(2, ok, "all 3 video sources + posters rendered (data-driven)" as *u8) 63 64 // R3: inline player present (the YouTube-like grid of players) 65 ok = 0; if vg_has(buf1,len1,"<video controls" as *u8)==1 { if vg_has(buf1,len1,"poster=" as *u8)==1 { ok=1 } } 66 rows=rows+1; pass=pass+vg_row(3, ok, "inline video players present (controls + poster)" as *u8) 67 68 // R4: responsive by construction + onsite search 69 ok = 0; if vg_has(buf1,len1,"auto-fit" as *u8)==1 { if vg_has(buf1,len1,"width=device-width" as *u8)==1 { if vg_has(buf1,len1,"role=\"search\"" as *u8)==1 { ok=1 } } } 70 rows=rows+1; pass=pass+vg_row(4, ok, "responsive grid + viewport + onsite search present" as *u8) 71 72 // R5 (NEG): a malicious video title is ESCAPED 73 let t2: *i64 = sys_mmap(8*8) as *i64; let th2: *i64 = sys_mmap(8*8) as *i64; let u2: *i64 = sys_mmap(8*8) as *i64 74 t2[0]="<script>alert(5)</script>" as *u8 as i64; th2[0]="/t.jpg" as *u8 as i64; u2[0]="/v.mp4" as *u8 as i64 75 let bufi: *u8 = sys_mmap(65536) 76 let leni: i64 = vg_build_file("/tmp/nx_video_inj.html" as *u8, "T" as *u8, "H" as *u8, t2, th2, u2, 1, bufi, 65535) 77 ok = 0; if vg_has(bufi,leni,"<script>alert(5)" as *u8)==0 { if vg_has(bufi,leni,"&lt;script&gt;alert(5)" as *u8)==1 { ok=1 } } 78 rows=rows+1; pass=pass+vg_row(5, ok, "malicious video title escaped, no raw <script> (neg control)" as *u8) 79 80 // R6 (data-driven): a 2nd different gallery is genuinely different 81 let t3: *i64 = sys_mmap(8*8) as *i64; let th3: *i64 = sys_mmap(8*8) as *i64; let u3: *i64 = sys_mmap(8*8) as *i64 82 t3[0]="A Totally Different Cat" as *u8 as i64; th3[0]="/d.jpg" as *u8 as i64; u3[0]="/dcat.mp4" as *u8 as i64 83 let bufd: *u8 = sys_mmap(65536) 84 let lend: i64 = vg_build_file("/tmp/nx_video_d.html" as *u8, "Other Site" as *u8, "Other" as *u8, t3, th3, u3, 1, bufd, 65535) 85 ok = 0; if vg_has(bufd,lend,"A Totally Different Cat" as *u8)==1 { if vg_has(bufd,lend,"Whiskers naps in the sun" as *u8)==0 { ok=1 } } 86 rows=rows+1; pass=pass+vg_row(6, ok, "2nd different gallery, no bleed from the 1st (general, not one-off)" as *u8) 87 88 // R7 (determinism): same data -> byte-identical 89 let buf2: *u8 = sys_mmap(262144) 90 let len2: i64 = vg_build_file("/tmp/nx_video_pets2.html" as *u8, "Nishi Pets -- watch our family pets" as *u8, "Latest pet videos" as *u8, t, th, u, 3, buf2, 262143) 91 ok = vg_eq(buf1, len1, buf2, len2) 92 rows=rows+1; pass=pass+vg_row(7, ok, "deterministic: same data -> byte-identical build (reproducible)" as *u8) 93 94 vg_w("NX-SITEGEN-VIDEO-GATE rows=" as *u8); vg_num(rows); vg_w(" pass=" as *u8); vg_num(pass); vg_w("\n" as *u8) 95 if pass == rows { 96 let line: *u8 = sys_mmap(256) 97 var off: i64 = vg_cat(line, 0, "CMSGATE row=nx_sitegen_video site-builder-video rows=" as *u8) 98 off = vg_catnum(line, off, rows); off = vg_cat(line, off, " pass=" as *u8); off = vg_catnum(line, off, pass) 99 off = vg_cat(line, off, " verdict=PASS\n" as *u8) 100 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4) 101 if gf >= 0 { sys_write(gf, line, off); sys_close(gf) } 102 vg_w("NX-SITEGEN-VIDEO-GATE verdict=PASS -- video-gallery page type recorded in cms_gate.log\n" as *u8) 103 sys_exit(0); return 0 104 } 105 vg_w("NX-SITEGEN-VIDEO-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8) 106 sys_exit(1); return 1 107}