code wiki / (root) / nx_url_resolve.nx
`nx_url_resolve.nx` source

↩ module page · 367 lines · 14949 B
1// nx_url_resolve.nx -- RFC 3986 §5.2 relative-URL resolution.
2//
3// Given a base URL (assumed absolute: scheme://authority/path...)
4// and a reference URL (absolute, scheme-relative, path-absolute,
5// path-relative, or fragment-only), compute the resolved absolute
6// URL and write it to caller-supplied output buffer.
7//
8// This is the substrate primitive Arc B2 needs to turn the raw
9// <img src="..."> values harvested from a Google response into
10// fetchable absolute URLs.
11//
12// Covered cases (in roughly the order RFC 3986 §5.2 specifies):
13//   - rel is absolute (has its own scheme):  output = rel verbatim
14//   - rel starts with "//":                  output = base.scheme + ":" + rel
15//   - rel starts with "/":                   output = base.scheme + "://" + base.authority + rel
16//   - rel is empty or "#frag":               output = base with optional new fragment
17//   - rel is path-relative:                  output = base.scheme + "://" + base.authority +
18//                                                     merged-and-dot-resolved path + rel.query/frag
19//
20// Out of scope (deferred to a real-Google-response-driven slice):
21//   - userinfo (user:pass@host)
22//   - IPv6 [..] hosts
23//   - punycode/IDN
24//   - normalize_case of host (spec says lower)
25//   - percent-decode/re-encode round-trip
26//
27// nx_safety_envelope:
28//   intended_use:       "Relative-URL resolution for HTML href/src in
29//                        the bits-up browser substrate."
30//   sil_target:         SIL1
31//   evidence:           [RFC3986_section_5_2_canonical_basis,
32//                        bounded_output_buffer,
33//                        substrate_honest_truncation_signal]
34//   hazard_register:    [bug-tape-path-traversal-via-dot-dot,
35//                        bug-tape-host-substitution-via-malformed-base]
36//   residual_risk:      "Caller is responsible for sandboxing fetch
37//                        targets; resolver does not enforce origin
38//                        policy."
39//   verdict:            NOT_YET_EVALUATED
40
41import "nx_syscalls.nx"
42
43// Return values.
44const NX_URL_RESOLVE_OK: i64 = 0
45const NX_URL_RESOLVE_TRUNC: i64 = -1     // output buffer too small
46const NX_URL_RESOLVE_BAD_BASE: i64 = -2  // base is not a usable absolute URL
47
48func _ur_lc(b: i64) -> i64 {
  if b >= 65 { if b <= 90 { return b + 32 } }
  return b
51}
52
53// Find ':' before any '/' or '?' or '#' -- presence of a scheme.
54// Returns the offset of ':' or -1.
55func _ur_find_scheme_colon(s: *u8, slen: i64) -> i64 {
  if slen < 2 { return 0 - 1 }
  // First byte must be alpha.
  let c0: i64 = _ur_lc(s[0])
  if c0 < 97 { return 0 - 1 }
  if c0 > 122 { return 0 - 1 }
  var i: i64 = 1
  while i < slen {
      let b: i64 = s[i]
      if b == 58 { return i }           // ':'
      if b == 47 { return 0 - 1 }       // '/'
      if b == 63 { return 0 - 1 }       // '?'
      if b == 35 { return 0 - 1 }       // '#'
      let lcb: i64 = _ur_lc(b)
      var ok: i64 = 0
      if lcb >= 97 { if lcb <= 122 { ok = 1 } }
      if b >= 48  { if b <= 57   { ok = 1 } }    // digit
      if b == 43 { ok = 1 }                       // '+'
      if b == 45 { ok = 1 }                       // '-'
      if b == 46 { ok = 1 }                       // '.'
      if ok == 0 { return 0 - 1 }
      i = i + 1
  }
  return 0 - 1
79}
80
81// Write byte to out, returning new pos, or -1 if would overflow.
82func _ur_putc(out: *u8, pos: i64, cap: i64, b: i64) -> i64 {
  if pos >= cap { return 0 - 1 }
  out[pos] = b as u8
  return pos + 1
86}
87
88// Copy src[so..so+sn] to out, returning new pos, or -1 on overflow.
89func _ur_copy(out: *u8, pos: i64, cap: i64, src: *u8, so: i64, sn: i64) -> i64 {
  var p: i64 = pos
  var i: i64 = 0
  while i < sn {
      if p >= cap { return 0 - 1 }
      out[p] = src[so + i]
      p = p + 1
      i = i + 1
  }
  return p
99}
100
101// Remove "." and ".." segments per RFC 3986 §5.2.4.  Operates on a
102// path string (which may start with '/').  Writes resolved path to
103// out starting at pos.
104//
105// Algorithm: scan path left-to-right, maintaining a stack of
106// already-emitted segments (their start offsets in out).  For each
107// segment:
108//   - "."     -> skip
109//   - ".."    -> pop last emitted segment
110//   - other   -> append
111// Preserves leading '/' if original path had one.
112func _ur_resolve_dot_segments(path: *u8, plen: i64,
                            out: *u8, pos_in: i64, cap: i64,
                            seg_off: *i64, seg_cnt_p: *i64) -> i64 {
  var p: i64 = pos_in
  var seg_cnt: i64 = 0
  var i: i64 = 0
  var has_leading_slash: i64 = 0
  var last_was_dot: i64 = 0       // last segment was "." or ".."
  if plen > 0 { if path[0] == 47 { has_leading_slash = 1; i = 1 } }
  while i < plen {
      // Find segment bounds: seg_start..seg_end where seg_end is next '/' or plen.
      let seg_start: i64 = i
      var seg_end: i64 = plen
      var scan: i64 = i
      while scan < plen {
          if path[scan] == 47 { seg_end = scan; scan = plen }
          else { scan = scan + 1 }
      }
      let seg_len: i64 = seg_end - seg_start
      // Advance i past the segment AND the trailing '/' (if any).
      i = seg_end
      if i < plen { if path[i] == 47 { i = i + 1 } }
      // Classify.
      var kind: i64 = 0      // 0 normal, 1 ".", 2 ".."
      if seg_len == 1 { if path[seg_start] == 46 { kind = 1 } }
      if seg_len == 2 { if path[seg_start] == 46 { if path[seg_start + 1] == 46 { kind = 2 } } }
      if kind == 0 {
          var emit_slash: i64 = 0
          if has_leading_slash == 1 { emit_slash = 1 }
          else { if seg_cnt > 0 { emit_slash = 1 } }
          if emit_slash == 1 {
              p = _ur_putc(out, p, cap, 47)
              if p < 0 { return 0 - 1 }
          }
          seg_off[seg_cnt] = p
          p = _ur_copy(out, p, cap, path, seg_start, seg_len)
          if p < 0 { return 0 - 1 }
          seg_cnt = seg_cnt + 1
          last_was_dot = 0
      }
      if kind == 2 {
          if seg_cnt > 0 {
              seg_cnt = seg_cnt - 1
              p = seg_off[seg_cnt]
              if has_leading_slash == 1 { if p > pos_in { p = p - 1 } }   // drop preceding '/'
          }
          last_was_dot = 1
      }
      if kind == 1 { last_was_dot = 1 }
  }
  // Trailing-slash preservation per RFC 3986 §5.2.4 step 2D:
  //   - input ended with '/' -> output ends with '/'
  //   - input's final segment was "." or ".." -> output ends with '/'
  if plen > 0 {
      var need_trailing: i64 = 0
      if path[plen - 1] == 47 { need_trailing = 1 }
      if last_was_dot == 1 { need_trailing = 1 }
      if need_trailing == 1 {
          // For absolute paths we always want at least "/"; for empty
          // output that means emit "/".
          if p == pos_in {
              if has_leading_slash == 1 {
                  p = _ur_putc(out, p, cap, 47)
                  if p < 0 { return 0 - 1 }
              }
          } else {
              if out[p - 1] != 47 {
                  p = _ur_putc(out, p, cap, 47)
                  if p < 0 { return 0 - 1 }
              }
          }
      }
  }
  seg_cnt_p[0] = seg_cnt
  return p
187}
188
189// Top-level: resolve `rel` against `base`, emit into `out`.
190// Returns NX_URL_RESOLVE_OK on success or a negative error code.
191// out_len_p receives the byte length written.
192func nx_url_resolve(base: *u8, base_len: i64,
                  rel: *u8, rel_len: i64,
                  out: *u8, out_cap: i64,
                  out_len_p: *i64) -> i64 {
  var pos: i64 = 0
197
  // Case 1: rel is empty -> resolved = base.
  if rel_len == 0 {
      pos = _ur_copy(out, pos, out_cap, base, 0, base_len)
      if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
      out_len_p[0] = pos
      return NX_URL_RESOLVE_OK
  }
205
  // Case 2: rel has its own scheme -> use rel verbatim.
  let rel_scheme_colon: i64 = _ur_find_scheme_colon(rel, rel_len)
  if rel_scheme_colon > 0 {
      pos = _ur_copy(out, pos, out_cap, rel, 0, rel_len)
      if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
      out_len_p[0] = pos
      return NX_URL_RESOLVE_OK
  }
214
  // Need base to be absolute (have a scheme) for any of the
  // remaining cases.
  let base_scheme_colon: i64 = _ur_find_scheme_colon(base, base_len)
  if base_scheme_colon <= 0 { return NX_URL_RESOLVE_BAD_BASE }
219
  // Extract base.scheme + ":" prefix length.
  let scheme_prefix_len: i64 = base_scheme_colon + 1
222
  // Base must have "//" right after the scheme ':' for our subset.
  if scheme_prefix_len + 2 > base_len { return NX_URL_RESOLVE_BAD_BASE }
  if base[scheme_prefix_len] != 47     { return NX_URL_RESOLVE_BAD_BASE }
  if base[scheme_prefix_len + 1] != 47 { return NX_URL_RESOLVE_BAD_BASE }
227
  // Find base authority (host[:port]) end -- first '/' or '?' or '#' or end.
  let auth_start: i64 = scheme_prefix_len + 2
  var auth_end: i64 = base_len
  var ae_scan: i64 = auth_start
  while ae_scan < base_len {
      let b: i64 = base[ae_scan]
      if b == 47 { auth_end = ae_scan; ae_scan = base_len }
      else { if b == 63 { auth_end = ae_scan; ae_scan = base_len }
      else { if b == 35 { auth_end = ae_scan; ae_scan = base_len }
      else { ae_scan = ae_scan + 1 } } }
  }
239
  // Base path = from auth_end up to '?' or '#' or end.
  var path_end: i64 = base_len
  var pe_scan: i64 = auth_end
  while pe_scan < base_len {
      let pb: i64 = base[pe_scan]
      if pb == 63 { path_end = pe_scan; pe_scan = base_len }
      else { if pb == 35 { path_end = pe_scan; pe_scan = base_len }
      else { pe_scan = pe_scan + 1 } }
  }
  let base_path_off: i64 = auth_end
  let base_path_len: i64 = path_end - auth_end
251
  // Case 3: rel starts with "//" -> scheme-relative.
  if rel_len >= 2 {
      if rel[0] == 47 { if rel[1] == 47 {
          // out = base.scheme + ":" + rel
          pos = _ur_copy(out, pos, out_cap, base, 0, scheme_prefix_len)
          if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
          pos = _ur_copy(out, pos, out_cap, rel, 0, rel_len)
          if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
          out_len_p[0] = pos
          return NX_URL_RESOLVE_OK
      } }
  }
264
  // For all remaining cases we emit base.scheme + "://" + base.authority first.
  pos = _ur_copy(out, pos, out_cap, base, 0, auth_end)
  if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
268
  // Case 4: rel starts with "/" -> path-absolute.
  if rel[0] == 47 {
      // Apply remove-dot-segments to rel-as-path; append rel-as-suffix.
      // Simpler: take rel up to '?' or '#' as path, the rest as suffix.
      var rel_path_end: i64 = rel_len
      var rpe1_scan: i64 = 0
      while rpe1_scan < rel_len {
          let rb: i64 = rel[rpe1_scan]
          if rb == 63 { rel_path_end = rpe1_scan; rpe1_scan = rel_len }
          else { if rb == 35 { rel_path_end = rpe1_scan; rpe1_scan = rel_len }
          else { rpe1_scan = rpe1_scan + 1 } }
      }
      let seg_off: *i64 = sys_mmap(2048) as *i64    // 256 segments
      let seg_cnt_p: *i64 = sys_mmap(8) as *i64
      pos = _ur_resolve_dot_segments(rel, rel_path_end, out, pos, out_cap, seg_off, seg_cnt_p)
      if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
      if rel_path_end < rel_len {
          pos = _ur_copy(out, pos, out_cap, rel, rel_path_end, rel_len - rel_path_end)
          if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
      }
      out_len_p[0] = pos
      return NX_URL_RESOLVE_OK
  }
292
  // Case 5: rel is fragment-only -> base path + base query + rel fragment.
  if rel[0] == 35 {
      // emit base path + query (everything from auth_end up to '#' or end of base).
      var base_no_frag_end: i64 = base_len
      var bnf_scan: i64 = auth_end
      while bnf_scan < base_len {
          if base[bnf_scan] == 35 { base_no_frag_end = bnf_scan; bnf_scan = base_len }
          else { bnf_scan = bnf_scan + 1 }
      }
      pos = _ur_copy(out, pos, out_cap, base, auth_end, base_no_frag_end - auth_end)
      if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
      pos = _ur_copy(out, pos, out_cap, rel, 0, rel_len)
      if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
      out_len_p[0] = pos
      return NX_URL_RESOLVE_OK
  }
309
  // Case 6: rel is query-only.
  if rel[0] == 63 {
      // base path (no query no frag) + rel.
      pos = _ur_copy(out, pos, out_cap, base, auth_end, base_path_len)
      if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
      pos = _ur_copy(out, pos, out_cap, rel, 0, rel_len)
      if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
      out_len_p[0] = pos
      return NX_URL_RESOLVE_OK
  }
320
  // Case 7: rel is path-relative.  Merge base path dirname + rel path
  // then apply remove-dot-segments.
  var rel_path_end: i64 = rel_len
  var rpe_scan: i64 = 0
  while rpe_scan < rel_len {
      let rb2: i64 = rel[rpe_scan]
      if rb2 == 63 { rel_path_end = rpe_scan; rpe_scan = rel_len }
      else { if rb2 == 35 { rel_path_end = rpe_scan; rpe_scan = rel_len }
      else { rpe_scan = rpe_scan + 1 } }
  }
331
  // Find dirname of base path = up to and including last '/' (or "/" if no '/').
  var dir_end: i64 = base_path_off
  var i: i64 = base_path_off
  while i < base_path_off + base_path_len {
      if base[i] == 47 { dir_end = i + 1 }
      i = i + 1
  }
  if dir_end == base_path_off {
      // base path had no '/' -- use "/" as base dirname.
      pos = _ur_putc(out, pos, out_cap, 47)
      if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
  }
344
  // Compose merged path into a scratch buffer, then dot-segment-resolve.
  let scratch_cap: i64 = 4096
  let scratch: *u8 = sys_mmap(scratch_cap)
  var sp: i64 = 0
  sp = _ur_copy(scratch, sp, scratch_cap, base, base_path_off, dir_end - base_path_off)
  if sp < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
  sp = _ur_copy(scratch, sp, scratch_cap, rel, 0, rel_path_end)
  if sp < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
353
  let seg_off2: *i64 = sys_mmap(2048) as *i64
  let seg_cnt_p2: *i64 = sys_mmap(8) as *i64
  pos = _ur_resolve_dot_segments(scratch, sp, out, pos, out_cap, seg_off2, seg_cnt_p2)
  if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
358
  // Append rel query+fragment suffix (if any).
  if rel_path_end < rel_len {
      pos = _ur_copy(out, pos, out_cap, rel, rel_path_end, rel_len - rel_path_end)
      if pos < 0 { out_len_p[0] = 0; return NX_URL_RESOLVE_TRUNC }
  }
364
  out_len_p[0] = pos
  return NX_URL_RESOLVE_OK
367}
nx_url_resolve.nx source

`nx_url_resolve.nx` source
