// Android host-app shell for the POC. Build into any minimal APK that embeds
// a system WebView (or a locally-built WebView from the patched Chromium tree)
// and point it at the POC server.
//
// Precondition for the bypass: the renderer is "compromised", simulated here by
// applying chromium-changes.patch to the WebView's Blink and rebuilding.

package org.chromium.poc.webview3pc;

import android.app.Activity;
import android.os.Bundle;
import android.webkit.CookieManager;
import android.webkit.WebSettings;
import android.webkit.WebView;
import android.webkit.WebViewClient;

public class WebViewPocActivity extends Activity {
    // Replace with the host running server.py.
    private static final String VICTIM_URL = "http://victim.example:8080/victim.html";
    private static final String TRACKER_SET = "http://tracker.example:8081/set";

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        WebView wv = new WebView(this);
        setContentView(wv);

        WebSettings s = wv.getSettings();
        s.setJavaScriptEnabled(true);

        CookieManager cm = CookieManager.getInstance();
        cm.setAcceptCookie(true);
        // The setting under test: third-party cookies are DISABLED for this
        // WebView. AwProxyingRestrictedCookieManager is the sole enforcement
        // layer for this setting.
        cm.setAcceptThirdPartyCookies(wv, false);

        wv.setWebViewClient(new WebViewClient() {
            private boolean primed = false;
            @Override
            public void onPageFinished(WebView view, String url) {
                if (!primed && url.startsWith("http://tracker.example")) {
                    // First-party visit set the unpartitioned cookie; now load
                    // the cross-site embedding scenario.
                    primed = true;
                    view.loadUrl(VICTIM_URL);
                }
            }
        });

        // Step 1: visit tracker.example top-level so it can set its
        // unpartitioned SameSite=None cookie (this is allowed; it's 1P here).
        wv.loadUrl(TRACKER_SET);
        // Step 2 (via onPageFinished): load victim.example which iframes
        // tracker.example. The iframe's document.cookie read goes through
        // AwProxyingRestrictedCookieManager with the (spoofed) site_for_cookies.
    }
}