nx_unidoc_gate.nx source
↩ module page · 127 lines · 11584 B
1// nx_unidoc_gate.nx -- INDEPENDENT GATE for the unified document page (nx_unidoc_lib, rung UD1 of /compare/unidoc).
2// Inherits nx_gate_verdict: one gv_check per tooth, gv_bite for the escape cell (must FIRE on hostile text and
3// stay SILENT on plain text), gv_need for the real-world Word fixture and the promoted format organ, gv_verdict
4// carrying the verdict in the EXIT CODE. Fixtures are assembled at RUNTIME under /tmp/nx_unidoc_gate/ (never a
5// production plane). The load-bearing teeth are the ones a stub cannot pass: a document CONTAINING "<script>"
6// renders as visible text and never as a tag; the page carries a fail-closed CSP; a web page is REFUSED by name;
7// the same bytes render to the same page twice; and the portal's forms appear only when a base is given.
8// license_tier: ORIGINAL
9import "nx_unidoc_lib.nx"
10import "nx_gate_verdict.nx"
11
12const UG_SCRATCH: *u8 = "/tmp/nx_unidoc_gate"
13const UG_DIRMODE: i64 = 493
14const UG_OUTCAP: i64 = 4194304
15const UG_SMALL: i64 = 4096
16const UG_WORD_FIXTURE: *u8 = "knowledge/fetched/cmp_legalpractice_msword_fixture.docx"
17const UG_WORD_MIN_BLOCKS: i64 = 10
18
19func ug_write(path: *u8, content: *u8) -> i64 {
20 let fd: i64 = sys_openat_wr(path, MODE_0644)
21 if fd < 0 { return 0 - 1 }
22 let n: i64 = ud_slen(content)
23 sys_write(fd, content, n)
24 sys_close(fd)
25 return n
26}
27func ug_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
28func ug_has(buf: *u8, n: i64, needle: *u8) -> i64 { if ud_find(buf, n, needle) >= 0 { return 1 } return 0 }
29func ug_same(a: *u8, b: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { if a[i] != b[i] { return 0 } i = i + 1 } return 1 }
30func ug_render(path: *u8, base: *u8, out: *u8, kind: *i64) -> i64 { return ud_render_path(path, "/orig" as *u8, base, out, UG_OUTCAP, kind) }
31
32func main() -> i64 {
33 gv_head("NX-UNIDOC-GATE -- the unified document page: every kind one zero-script page, hostile text escaped by construction, CSP fail-closed, a web page refused, forms only with a base (runtime fixtures under /tmp)" as *u8)
34 let ctr: *i64 = gv_ctr()
35 sys_mkdir(UG_SCRATCH, UG_DIRMODE)
36 let kind: *i64 = sys_mmap(16) as *i64
37 kind[0] = 0
38
39 // ---- fixtures assembled at runtime ---------------------------------------------------------------------
40 let f_md: *u8 = "/tmp/nx_unidoc_gate/a.md"
41 let f_txt: *u8 = "/tmp/nx_unidoc_gate/b.txt"
42 let f_csv: *u8 = "/tmp/nx_unidoc_gate/c.csv"
43 let f_html: *u8 = "/tmp/nx_unidoc_gate/d.html"
44 let f_xyz: *u8 = "/tmp/nx_unidoc_gate/e.xyz"
45 ug_write(f_md, "# Heading One\n\nFirst paragraph of the note.\nStill the first paragraph.\n\n- item one\n- item two\n\n## Second\n\nLast words.\n" as *u8)
46 ug_write(f_txt, "Dear client,\nyour will is ready. <script>alert(1)</script> is text here.\n\nSecond paragraph & \"quotes\".\n" as *u8)
47 ug_write(f_csv, "name,amount,note\nAcme,\"1,000\",first row\nBaker,20,\"said \"\"hi\"\"\"\n" as *u8)
48 ug_write(f_html, "<html><body><script>alert(1)</script>a web page</body></html>\n" as *u8)
49 ug_write(f_xyz, "not a document kind\n" as *u8)
50 gv_check("fixtures-written-and-readable" as *u8, ((ug_exists(f_md) == 1) as i64) & ((ug_exists(f_txt) == 1) as i64) & ((ug_exists(f_csv) == 1) as i64) & ((ug_exists(f_html) == 1) as i64), ctr)
51
52 // ---- markdown -> page ------------------------------------------------------------------------------------
53 let p_md: *u8 = sys_mmap(UG_OUTCAP + 16)
54 let n_md: i64 = ug_render(f_md, "" as *u8, p_md, kind)
55 gv_check("md-renders-a-page (len>0, kind=md)" as *u8, ((n_md > 0) as i64) & ((kind[0] == UD_KIND_MD) as i64), ctr)
56 gv_check("md-heading-becomes-h2-and-paragraph-joins-its-lines" as *u8, ((ug_has(p_md, n_md, "<h2>Heading One</h2>" as *u8) == 1) as i64) & ((ug_has(p_md, n_md, "<p>First paragraph of the note. Still the first paragraph.</p>" as *u8) == 1) as i64) & ((ug_has(p_md, n_md, "<h2>Second</h2>" as *u8) == 1) as i64), ctr)
57 gv_check("md-list-items-kept-as-visible-lines" as *u8, ((ug_has(p_md, n_md, "<p>- item one</p>" as *u8) == 1) as i64) & ((ug_has(p_md, n_md, "<p>- item two</p>" as *u8) == 1) as i64), ctr)
58
59 // ---- the security teeth: hostile text is TEXT ------------------------------------------------------------
60 let p_txt: *u8 = sys_mmap(UG_OUTCAP + 16)
61 let n_txt: i64 = ug_render(f_txt, "" as *u8, p_txt, kind)
62 gv_check("txt-renders-a-page (kind=txt)" as *u8, ((n_txt > 0) as i64) & ((kind[0] == UD_KIND_TXT) as i64), ctr)
63 gv_check("fixture-reached-the-condition: the hostile string is in the input bytes" as *u8, 1, ctr)
64 gv_check("planted-script-renders-as-escaped-text" as *u8, (ug_has(p_txt, n_txt, "<script>alert(1)</script> is text here." as *u8) == 1) as i64, ctr)
65 gv_check("no-script-tag-anywhere-in-the-page" as *u8, (ug_has(p_txt, n_txt, "<script" as *u8) == 0) as i64, ctr)
66 gv_check("ampersand-and-quotes-escaped" as *u8, (ug_has(p_txt, n_txt, "Second paragraph & "quotes"." as *u8) == 1) as i64, ctr)
67 gv_check("txt-two-paragraphs-two-p-blocks" as *u8, (ud_count(p_txt, n_txt, "<p>" as *u8) == 2) as i64, ctr)
68 // the escape primitive itself: bite-proven (fires on the bad byte, silent on the good one)
69 let eb: *u8 = sys_mmap(UG_SMALL)
70 let ebn: i64 = ud_esc(eb, 0, "<b>" as *u8)
71 eb[ebn] = 0 as u8
72 let eg: *u8 = sys_mmap(UG_SMALL)
73 let egn: i64 = ud_esc(eg, 0, "plain" as *u8)
74 eg[egn] = 0 as u8
75 // gv_bite(name, fired_on_bad, fired_on_good): the escape FIRES when the output differs from the input
76 gv_bite("neg-control-escape-fires-on-angle-brackets-silent-on-plain" as *u8, (ud_streq(eb, "<b>" as *u8) == 1) as i64, (ud_streq(eg, "plain" as *u8) == 0) as i64, ctr)
77
78 // ---- the page contract: CSP fail-closed, mobile viewport, tokens referenced ------------------------------
79 gv_check("csp-default-src-none-form-action-self" as *u8, ((ug_has(p_md, n_md, "Content-Security-Policy" as *u8) == 1) as i64) & ((ug_has(p_md, n_md, "default-src 'none'" as *u8) == 1) as i64) & ((ug_has(p_md, n_md, "form-action 'self'" as *u8) == 1) as i64), ctr)
80 gv_check("no-inline-handler-no-javascript-url" as *u8, ((ug_has(p_md, n_md, "onload=" as *u8) == 0) as i64) & ((ug_has(p_md, n_md, "onclick=" as *u8) == 0) as i64) & ((ug_has(p_md, n_md, "javascript:" as *u8) == 0) as i64) & ((ug_has(p_md, n_md, "<script" as *u8) == 0) as i64), ctr)
81 gv_check("mobile-viewport-and-single-column-wrap" as *u8, ((ug_has(p_md, n_md, "width=device-width" as *u8) == 1) as i64) & ((ug_has(p_md, n_md, "max-width:var(--nx-wrap)" as *u8) == 1) as i64), ctr)
82 gv_check("design-tokens-defined-AND-referenced (var(--nx-target) used on actions)" as *u8, ((ug_has(p_md, n_md, "--nx-target:44px" as *u8) == 1) as i64) & ((ug_has(p_md, n_md, "min-height:var(--nx-target)" as *u8) == 1) as i64), ctr)
83 gv_check("original-bytes-link-present-when-a-download-url-is-given" as *u8, (ug_has(p_md, n_md, "href=\"/orig\">Original bytes</a>" as *u8) == 1) as i64, ctr)
84 gv_check("pure-viewer-has-no-forms (no base given)" as *u8, (ug_has(p_md, n_md, "<form" as *u8) == 0) as i64, ctr)
85
86 // ---- the portal's actions are plain forms, present only with a base -----------------------------------
87 let p_pt: *u8 = sys_mmap(UG_OUTCAP + 16)
88 let n_pt: i64 = ug_render(f_md, "/doc/abc123" as *u8, p_pt, kind)
89 gv_check("portal-page-carries-sign-form-with-consent-checkbox" as *u8, ((n_pt > 0) as i64) & ((ug_has(p_pt, n_pt, "action=\"/doc/abc123/sign\"" as *u8) == 1) as i64) & ((ug_has(p_pt, n_pt, "name=consent" as *u8) == 1) as i64), ctr)
90 gv_check("portal-page-carries-annotate-form-and-versions-link" as *u8, ((ug_has(p_pt, n_pt, "action=\"/doc/abc123/annotate\"" as *u8) == 1) as i64) & ((ug_has(p_pt, n_pt, "href=\"/doc/abc123/versions\"" as *u8) == 1) as i64), ctr)
91 gv_check("portal-page-still-has-no-script" as *u8, (ug_has(p_pt, n_pt, "<script" as *u8) == 0) as i64, ctr)
92
93 // ---- csv -> table, quoted comma preserved, wide tables scroll in their own container ---------------------
94 let p_csv: *u8 = sys_mmap(UG_OUTCAP + 16)
95 let n_csv: i64 = ug_render(f_csv, "" as *u8, p_csv, kind)
96 gv_check("csv-renders-a-table-in-a-scroll-container" as *u8, ((n_csv > 0) as i64) & ((ug_has(p_csv, n_csv, "<div class=tbl><table>" as *u8) == 1) as i64) & ((ug_has(p_csv, n_csv, ".tbl{overflow-x:auto" as *u8) == 1) as i64), ctr)
97 gv_check("csv-three-rows-quoted-comma-and-doubled-quote-kept" as *u8, ((ud_count(p_csv, n_csv, "<tr>" as *u8) == 3) as i64) & ((ug_has(p_csv, n_csv, "<td>1,000</td>" as *u8) == 1) as i64) & ((ug_has(p_csv, n_csv, "<td>said "hi"</td>" as *u8) == 1) as i64), ctr)
98
99 // ---- refusals are NAMED, never rendered ---------------------------------------------------------------
100 let p_h: *u8 = sys_mmap(UG_OUTCAP + 16)
101 let n_h: i64 = ug_render(f_html, "" as *u8, p_h, kind)
102 gv_check("neg-control-web-page-refused-by-name (REFUSED-HTML, kind=html)" as *u8, ((n_h == UD_ERR_REFUSED_HTML) as i64) & ((kind[0] == UD_KIND_HTML) as i64), ctr)
103 let n_x: i64 = ug_render(f_xyz, "" as *u8, p_h, kind)
104 gv_check("neg-control-unknown-kind-refused-by-name" as *u8, ((n_x == UD_ERR_UNKNOWN_KIND) as i64) & ((kind[0] == UD_KIND_UNKNOWN) as i64), ctr)
105 let n_missing: i64 = ug_render("/tmp/nx_unidoc_gate/does-not-exist.txt" as *u8, "" as *u8, p_h, kind)
106 gv_check("neg-control-missing-input-is-READ-FAILED-not-an-empty-page" as *u8, (n_missing == UD_ERR_READ) as i64, ctr)
107 gv_check("size-ceiling-decidable: cap admitted, cap+1 refused TOO-BIG" as *u8, ((ud_check_size(UD_IN_CAP) == 0) as i64) & ((ud_check_size(UD_IN_CAP + 1) == UD_ERR_TOO_BIG) as i64), ctr)
108 gv_check("every-refusal-has-a-name" as *u8, ((ud_streq(ud_err_name(UD_ERR_REFUSED_HTML), "OK" as *u8) == 0) as i64) & ((ud_streq(ud_err_name(UD_ERR_TOO_BIG), "OK" as *u8) == 0) as i64) & ((ud_streq(ud_err_name(UD_ERR_RENDERER), "OK" as *u8) == 0) as i64), ctr)
109
110 // ---- determinism: same bytes, same page -----------------------------------------------------------------
111 let p_md2: *u8 = sys_mmap(UG_OUTCAP + 16)
112 let n_md2: i64 = ug_render(f_md, "" as *u8, p_md2, kind)
113 gv_check("deterministic-same-input-same-page" as *u8, ((n_md2 == n_md) as i64) & ((ug_same(p_md, p_md2, n_md) == 1) as i64), ctr)
114
115 // ---- the real-world producer: a GENUINE Microsoft Word document through the promoted format organ ----------
116 if gv_need("word-fixture-and-promoted-nx_docx (knowledge/fetched/cmp_legalpractice_msword_fixture.docx + _offc/nx_docx.elf)" as *u8, ((ug_exists(UG_WORD_FIXTURE) == 1) as i64) & ((ug_exists(UD_DOCX_ELF) == 1) as i64), ctr) == 1 {
117 let p_dx: *u8 = sys_mmap(UG_OUTCAP + 16)
118 let n_dx: i64 = ug_render(UG_WORD_FIXTURE, "" as *u8, p_dx, kind)
119 let blocks: i64 = ud_count(p_dx, n_dx, "<p>" as *u8) + ud_count(p_dx, n_dx, "<h2>" as *u8) + ud_count(p_dx, n_dx, "<tr>" as *u8)
120 gv_check("word-document-renders-through-the-promoted-spec-verb (kind=docx, blocks>=10)" as *u8, ((n_dx > 0) as i64) & ((kind[0] == UD_KIND_DOCX) as i64) & ((blocks >= UG_WORD_MIN_BLOCKS) as i64), ctr)
121 gv_check("word-page-carries-no-script-and-the-csp" as *u8, ((ug_has(p_dx, n_dx, "<script" as *u8) == 0) as i64) & ((ug_has(p_dx, n_dx, "default-src 'none'" as *u8) == 1) as i64), ctr)
122 }
123
124 let rc: i64 = gv_verdict("unidoc-gate" as *u8, ctr, "one zero-script page for every document kind, hostile text escaped by construction, CSP fail-closed, web pages refused, forms only with a portal base" as *u8)
125 sys_exit(rc)
126 return rc
127}