#!/bin/bash
set -u
HERE="$(cd "$(dirname "$0")" && pwd)"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PROFILE="$(mktemp -d /tmp/chrome-poc-profile.XXXXXX)"
LOG="$HERE/chrome.log"

cd "$HERE"
echo "[run] starting server..."
python3 server.py >server.log 2>&1 &
SRV=$!
trap 'kill $SRV 2>/dev/null; rm -rf "$PROFILE"' EXIT
sleep 1

echo "[run] launching chrome -> $LOG"
timeout 30 "$CHROME" \
  --headless=new \
  --no-first-run --no-default-browser-check --no-sandbox \
  --disable-gpu --ignore-gpu-blocklist \
  --enable-logging=stderr --v=0 \
  --user-data-dir="$PROFILE" \
  "http://localhost:18080/poc.html" >"$LOG" 2>&1

echo
echo "===================== POC OUTPUT ====================="
grep -E '\[POC\]' "$LOG" | sed -E 's/.*\[POC\] /[POC] /; s/", source: http.*//' || true
echo "======================================================"
echo
if grep -q 'VULNERABILITY CONFIRMED' "$LOG"; then
  echo "[run] SUCCESS: opaque function name leaked via double-bind."
  exit 0
else
  echo "[run] did not observe leak; see $LOG"
  exit 1
fi