#!/usr/bin/env python3
# Serves poc.html and logs every request. If a request to /secret?token=...
# arrives, the attr()-security bypass fired (the URL came from an HTML
# attribute via attr() and reached a fetch sink).

import http.server
import socketserver
import sys
import os

PORT = 8081
HIT = {"secret": False, "control": False}


class H(http.server.SimpleHTTPRequestHandler):
    def __init__(self, *a, **kw):
        super().__init__(*a, directory=os.path.dirname(os.path.abspath(__file__)),
                         **kw)

    SEEN = set()

    def do_GET(self):
        p = self.path
        if p not in H.SEEN:
            sys.stderr.write(f"[server] GET {p}\n")
            sys.stderr.flush()
            H.SEEN.add(p)
        if p.startswith("/secret"):
            if not HIT["secret"]:
                sys.stderr.write(
                    "\n*** VULNERABILITY CONFIRMED: attr()-derived URL was "
                    "fetched ***\n"
                    f"***   path = {p}\n"
                    "***   attr-security taint was laundered through the\n"
                    "***   discrete transition on registered custom property.\n\n")
                sys.stderr.flush()
            HIT["secret"] = True
            self.send_response(200)
            self.send_header("Content-Type", "image/png")
            self.end_headers()
            return
        if p.startswith("/control-blocked"):
            HIT["control"] = True
            sys.stderr.write(
                "[server] NOTE: control case fired (unexpected — direct "
                "attr() in image-set should be blocked)\n")
            sys.stderr.flush()
            self.send_response(200)
            self.end_headers()
            return
        return super().do_GET()

    def log_message(self, *_):
        pass  # silence default logging


socketserver.TCPServer.allow_reuse_address = True
with socketserver.TCPServer(("127.0.0.1", PORT), H) as httpd:
    sys.stderr.write(f"[server] listening on http://127.0.0.1:{PORT}/\n")
    sys.stderr.flush()
    try:
        httpd.serve_forever()
    except KeyboardInterrupt:
        pass
    finally:
        sys.stderr.write(
            f"\n[server] summary: secret-fetched={HIT['secret']} "
            f"control-fetched={HIT['control']}\n")