#!/usr/bin/env python3
"""Serve the manual web-content half of the POC on :8080.

Map two hostnames to 127.0.0.1 (e.g. via /etc/hosts) so that the browser
treats them as distinct origins:
    127.0.0.1 a.localhost b.localhost
Then load http://a.localhost:8080/poc.html.

Note: in production Chrome the subresource filter only activates for hosts on
the Safe Browsing abusive-ads list, which cannot be faked from the command
line. The deterministic reproduction is the browser_test in
chromium-changes.patch; these files document the renderer-side half of the
attack (the timed cross-origin navigation).
"""
import http.server
import socketserver

PORT = 8080

class H(http.server.SimpleHTTPRequestHandler):
    def end_headers(self):
        self.send_header("Cache-Control", "no-store")
        super().end_headers()

if __name__ == "__main__":
    with socketserver.TCPServer(("", PORT), H) as httpd:
        print(f"serving on http://127.0.0.1:{PORT}")
        httpd.serve_forever()