#!/bin/bash
# Run the FLEDGE NaN priority_vector POC against an ASAN Chrome build.
#
# Usage:  CHROME=/path/to/out/asan/chrome ./run.sh
set -eu

HERE="$(cd "$(dirname "$0")" && pwd)"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PROFILE="$(mktemp -d /tmp/chrome-poc-profile.XXXXXX)"

cleanup() {
  [[ -n "${SERVER_PID:-}" ]] && kill "${SERVER_PID}" 2>/dev/null || true
  rm -rf "${PROFILE}" 2>/dev/null || true
}
trap cleanup EXIT

cd "${HERE}"
python3 server.py >server.log 2>&1 &
SERVER_PID=$!
# Give the server a moment to generate its certificate and bind the port.
for i in $(seq 1 30); do
  if curl -ksf "https://127.0.0.1:8443/ad.html" >/dev/null 2>&1; then break; fi
  sleep 0.2
done

# Privacy-Sandbox flags below are environment shims that stand in for a
# real, enrolled ad-tech origin and an opted-in user; they do not affect the
# vulnerable code path. --ignore-certificate-errors substitutes for a real
# TLS certificate. None of these gate the bug itself.
"${CHROME}" \
  --no-first-run --no-default-browser-check --disable-gpu --headless=new \
  --no-sandbox \
  --user-data-dir="${PROFILE}" \
  --ignore-certificate-errors \
  --host-resolver-rules='MAP a.test 127.0.0.1' \
  --enable-features=InterestGroupStorage,AdInterestGroupAPI,Fledge,PrivacySandboxAdsAPIsOverride,PrivacySandboxAdsAPIsM1Override,OverridePrivacySandboxSettingsLocalTesting \
  --disable-features=FledgeEnforceKAnonymity,EnforcePrivacySandboxAttestations \
  --privacy-sandbox-enrollment-overrides=https://a.test:8443 \
  --enable-logging=stderr --v=0 \
  https://a.test:8443/poc.html 2>&1