#!/usr/bin/env python3
"""
Serves victim.html on port 8080 (origin A) and attacker.html on port 8081
(origin B). Rewrites ATTACKER_ORIGIN in victim.html on the fly so the iframe
is cross-origin.

For a real Android repro you must serve these over HTTPS from two distinct
registrable domains (WebAuthn requires a secure context and a valid rpId),
e.g. behind a TLS-terminating reverse proxy mapping a.test -> :8080 and
b.test -> :8081, and add both to chrome://flags "Insecure origins treated
as secure" or use real certs.
"""
import http.server, socketserver, threading, os, sys

ROOT = os.path.dirname(os.path.abspath(__file__))
ATTACKER_ORIGIN = os.environ.get('ATTACKER_ORIGIN', 'http://localhost:8081')

class Handler(http.server.SimpleHTTPRequestHandler):
    def __init__(self, *a, **kw):
        super().__init__(*a, directory=ROOT, **kw)
    def do_GET(self):
        if self.path in ('/', '/victim.html'):
            with open(os.path.join(ROOT, 'victim.html'), 'rb') as f:
                body = f.read().replace(b'ATTACKER_ORIGIN',
                                        ATTACKER_ORIGIN.encode())
            self.send_response(200)
            self.send_header('Content-Type', 'text/html')
            self.send_header('Content-Length', str(len(body)))
            self.end_headers()
            self.wfile.write(body)
            return
        return super().do_GET()

def serve(port):
    socketserver.TCPServer.allow_reuse_address = True
    httpd = socketserver.TCPServer(('127.0.0.1', port), Handler)
    print(f'serving on 127.0.0.1:{port}', file=sys.stderr)
    httpd.serve_forever()

if __name__ == '__main__':
    threading.Thread(target=serve, args=(8081,), daemon=True).start()
    serve(8080)