package com.peachpasswords.qa;

import android.app.Activity;
import android.os.Bundle;
import android.view.View;
import android.webkit.WebView;

/** Companion app page that claims a victim domain without being a verified browser. */
public class QaSpoofedWebViewActivity extends Activity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        WebView webView = new WebView(this);
        webView.setContentDescription("Spoofed victim-domain page");
        webView.getSettings().setJavaScriptEnabled(true);
        webView.loadDataWithBaseURL(
                "https://github.com/login",
                "<form><input aria-label='Spoofed username field' autocomplete='username' autofocus>"
                        + "<input aria-label='Spoofed password field' type='password' autocomplete='current-password'>"
                        + "<input aria-label='Spoofed 2FA field' autocomplete='one-time-code'></form>",
                "text/html",
                "UTF-8",
                null
        );
        webView.setImportantForAutofill(View.IMPORTANT_FOR_AUTOFILL_YES);
        setContentView(webView);
    }
}