#!/usr/bin/env python3
"""
Victim HTTP server.

Serves /orb-poc-secret.json with Content-Type: application/json and
X-Content-Type-Options: nosniff. This combination is the canonical
ORB-blocked response: a no-CORS-protected MIME type with nosniff means
ORB must strip the body before it reaches an unprivileged renderer.

If an extension renderer can read this body via mode:'no-cors' fetch,
ORB has been bypassed for that renderer.
"""
import http.server
import socketserver
import sys

PORT = 8080
SECRET = b'{"secret":"ORB-BYPASS-PROOF-7f3a9e2c","user":"victim@example.com","session":"abc123"}'

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == "/orb-poc-secret.json":
            self.send_response(200)
            self.send_header("Content-Type", "application/json")
            self.send_header("X-Content-Type-Options", "nosniff")
            self.send_header("Content-Length", str(len(SECRET)))
            # No Access-Control-Allow-Origin header — this is a same-origin-only
            # endpoint. CORS will mark the response opaque; ORB is the only thing
            # preventing the body bytes from reaching a cross-origin renderer.
            self.end_headers()
            self.wfile.write(SECRET)
        else:
            self.send_response(404)
            self.end_headers()

    def log_message(self, fmt, *args):
        sys.stderr.write("[victim-server] %s\n" % (fmt % args))

if __name__ == "__main__":
    socketserver.TCPServer.allow_reuse_address = True
    with socketserver.TCPServer(("127.0.0.1", PORT), Handler) as httpd:
        print(f"victim server listening on http://127.0.0.1:{PORT}", flush=True)
        httpd.serve_forever()