#!/usr/bin/env python3
"""
POC beacon server for CSP sandbox \\f tokenizer differential.

Receives /report?variant=...&origin=...&opaque=... beacons from sandboxed
extension pages and logs them. The proof of bypass is:

  variant=bypass   origin=chrome-extension://<id>   opaque=false   <- BYPASS CONFIRMED
  variant=baseline origin=null                      opaque=true    <- normal sandboxing

Listens on 127.0.0.1:8080.
"""

import http.server
import socketserver
import urllib.parse
import sys
import os
import threading

PORT = 8081
LOG_PATH = os.path.join(os.path.dirname(os.path.abspath(__file__)), "results.log")

# Clear previous log
open(LOG_PATH, "w").close()

_lock = threading.Lock()
_reports = []

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        parsed = urllib.parse.urlparse(self.path)
        if parsed.path == "/report":
            qs = urllib.parse.parse_qs(parsed.query)
            variant = qs.get("variant", ["?"])[0]
            origin  = qs.get("origin",  ["?"])[0]
            opaque  = qs.get("opaque",  ["?"])[0]
            via     = qs.get("via",     ["fetch"])[0]

            verdict = ""
            if variant == "bypass":
                if origin.startswith("chrome-extension://"):
                    verdict = " *** BYPASS CONFIRMED — sandboxed page got non-opaque chrome-extension origin ***"
                elif origin == "null":
                    verdict = " (bypass FAILED — origin still opaque)"
            elif variant == "baseline":
                if origin == "null":
                    verdict = " (baseline behaving correctly — opaque origin)"
                else:
                    verdict = " (UNEXPECTED — baseline should be opaque)"

            line = f"[REPORT] variant={variant:10s} origin={origin:60s} opaque={opaque:6s} via={via}{verdict}"
            with _lock:
                _reports.append(line)
                print(line, flush=True)
                with open(LOG_PATH, "a") as f:
                    f.write(line + "\n")

            self.send_response(200)
            self.send_header("Access-Control-Allow-Origin", "*")
            self.send_header("Content-Type", "text/plain")
            self.end_headers()
            self.wfile.write(b"ok")
        else:
            self.send_response(404)
            self.end_headers()

    def log_message(self, fmt, *args):
        pass  # suppress default access log

class ReuseTCPServer(socketserver.TCPServer):
    allow_reuse_address = True

if __name__ == "__main__":
    print(f"[*] POC beacon server listening on http://127.0.0.1:{PORT}", flush=True)
    print(f"[*] Logging to {LOG_PATH}", flush=True)
    with ReuseTCPServer(("127.0.0.1", PORT), Handler) as httpd:
        try:
            httpd.serve_forever()
        except KeyboardInterrupt:
            print("\n[*] Shutting down", flush=True)