#!/usr/bin/env python3
"""
Serves the POC pages on two ports so that the attacker and victim are
cross-SITE (127.0.0.1 vs localhost) and therefore land in separate renderer
processes under default Site Isolation.

  http://127.0.0.1:8080/attacker.html   <- "compromised" web renderer
  http://localhost:8081/victim.html     <- cross-site victim tab
"""

import http.server
import os
import socketserver
import sys
import threading

ROOT = os.path.dirname(os.path.abspath(__file__))


class Handler(http.server.SimpleHTTPRequestHandler):
    def __init__(self, *a, **kw):
        super().__init__(*a, directory=ROOT, **kw)

    def do_POST(self):
        n = int(self.headers.get('Content-Length', '0'))
        body = self.rfile.read(n)
        sys.stderr.write(f"[server] POST {self.path} body={body!r}\n")
        self.send_response(200)
        self.send_header('Content-Type', 'text/plain')
        self.send_header('X-Server-Secret', 'victim-response-secret')
        self.end_headers()
        self.wfile.write(b'ok')

    def log_message(self, fmt, *args):
        sys.stderr.write("[server:%d] %s\n" %
                         (self.server.server_address[1], fmt % args))


class ReusableTCPServer(socketserver.TCPServer):
    allow_reuse_address = True


def serve(port):
    httpd = ReusableTCPServer(('0.0.0.0', port), Handler)
    sys.stderr.write(f"[server] listening on 0.0.0.0:{port}\n")
    httpd.serve_forever()


if __name__ == '__main__':
    threading.Thread(target=serve, args=(8080,), daemon=True).start()
    serve(8081)