15003 2007-08-19 02:14:41 -0700 Function.prototype.constructor should not be DontDelete/ReadOnly (Acid3 bug) 2008-02-08 17:06:43 -0800 1 1 1 Unclassified WebKit JavaScriptCore 523.x (Safari 3) All All RESOLVED FIXED javascript:function yn(v) { return v ? "yes" : "no"; }; function c() { }; delete c.prototype.constructor; var i = new c(); var res = (i.constructor !== Object.prototype.constructor); var allres = !res; var msg = "DontDelete: " + yn(res) + "\n"; function g() { }; g.prototype.constructor = 17; var i2 = new g(); res = (i2.constructor !== 17); allres = allres && !res; msg += "ReadOnly: " + yn(res) + "\n"; function h() { }; res = true; for (var prop in new h()) { if (prop == "constructor") res = false; }; msg += "DontEnum: " + yn(res); allres = allres && res; alert("Function.prototype.constructor attribute checks " + (allres ? "PASS" : "FAIL") + "\n" + msg); P2 Normal --- 17064 1 jwalden+bwo darin darin ddkilzer eric ggaren ian mjs sam oldest_to_newest 2006 0 jwalden+bwo 2007-08-19 02:14:41 -0700 13.2 Creating Function Objects 10. Set the "constructor" property of Result(9) [the newly-created prototype object for the Function object being created] to F [the Function object being created]. This property is given attributes { DontEnum }. This breaks hiding the constructor of an object from any code which sees that object, as an internals-hiding mechanism for constructor privateness. The relevant place to fix, at a glance, is: http://trac.webkit.org/projects/webkit/browser/trunk/JavaScriptCore/kjs/function_object.cpp#L248 It should be trivial to convert the URL test into a JavaScriptCore test and to remove the extra attributes from that line -- for someone who has the time to do that, that is. 1989 1 ddkilzer 2007-08-19 08:53:04 -0700 I believe there may be similar changes required in JavaScriptCore/kjs/nodes.cpp for FuncDeclNode::processFuncDecl(ExecState*) and FuncExprNode::evaluate(ExecState*) if this does indeed fix the bug. (I think the duplicate code should be refactored into its own method as well!) This bug reminded me of revision r19203: http://trac.webkit.org/projects/webkit/changeset/19203 Test case confirmed with a local debug build of WebKit r25142 with Safari 3 Public Beta v. 3.0.3 (522.12.1) on Mac OS X 10.4.10 (8R218). Both Opera 9.22 and Firefox 2.0.0.6 pass the given test. 65655 2 ian 2007-12-29 18:51:50 -0800 In the DontDelete test: I don't understand why the instance's constructor property would become Object.prototype.constructor instead of being removed altogether. 65674 3 jwalden+bwo 2007-12-29 20:52:46 -0800 (In reply to comment #2) > In the DontDelete test: I don't understand why the instance's constructor > property would become Object.prototype.constructor instead of being removed > altogether. It *is* removed, but you're only removing it from c.prototype, which per 13.2.2 step 4 and 13.2 steps 9-11 is a value created as if by new Object(). That object has as its prototype the Object prototype object (15.2.4), which has a constructor property which is Object.prototype.constructor, i.e. the built-in Object constructor (15.2.4.1), so getting the constructor property of |new c()| won't find it on that object, won't find it on the auto-created prototype, but will find it on Object.prototype. 65676 4 eric 2007-12-29 21:12:25 -0800 Acid3, test 87 tests for this bug. I would think it would be as simple as changing: JSObject* FunctionObjectImp::construct(ExecState* exec, const List& args, const Identifier& functionName, const UString& sourceURL, int lineNumber) to not put() the constructor property with ReadOnly an DontDelete. 65677 5 sam 2007-12-29 21:19:29 -0800 As Mr. Kilzer has already pointed out, you would also need to change FuncDeclNode::makeFunction. 66435 6 ian 2008-01-06 22:14:45 -0800 (In reply to comment #3) Thanks, that makes sense. 69767 7 19003 darin 2008-02-08 03:52:56 -0800 Created attachment 19003 patch 69817 8 19003 eric 2008-02-08 14:09:48 -0800 Comment on attachment 19003 patch the code change looks fine. I have concerns about the testing coverage. It should be possible to create a test which walked all functions on the window object and checked to make sure that their prototype.constructor was mutable, no? What about all of the HTML* elements which are being changed by your bindings .pl change. I would think those could be tested in some automated way. Perhaps the ideal for this sort of thing is to find a way for fast/window-properties.html to dump all of the DontDelete|DontEnum|ReadOnly information. 69865 9 darin 2008-02-08 15:09:32 -0800 (In reply to comment #8) > It should be possible to create a test which walked all functions on the window > object and checked to make sure that their prototype.constructor was mutable, > no? What about all of the HTML* elements which are being changed by your > bindings .pl change. I would think those could be tested in some automated > way. The reason I included the Node test was that I wanted to test at least one auto-generated example. I agree that we could expand the test to make sure it tests all the other generated constructors too. 69867 10 jwalden+bwo 2008-02-08 15:24:37 -0800 For the record, since I recently heard skepticism expressed on IRC over the value of this: Sometime near the beginning of August, Ajaxian had a blurb on Neil Mix's examination of Facebook's application platform and its security. For those who don't know, Facebook's app system consists of writing apps in a subset of HTML and JavaScript, modulo some Facebook-specific additions. The usual suspects are removed from HTML to make it safe, and the JS is run through a source-to-source translator to prevent unguarded access to any global variables, properties, etc. Runtime checks are inserted in various places to make checks which can't be done statically. This final code is then run on the facebook.com domain, with the full privileges of any facebook.com JS. The rewriting and checking are critical to preventing arbitrary XSS. I read Neil's posts on the exploits he found, and I decided to do some investigation of my own. Over the next couple weeks I found a good handful of exploits beyond the ones Neil found, as did a coworker at the time. Many of the exploits relied on Mozilla-specific features because that's what I happen to know best, but a fair number of them would work in any browser. By now you might be able to see where this is going. Neil Mix's original exploit was to do the following: (function(){}).constructor("alert('hi')")(); He reported this on his blog and noted the Facebook fix: Function.prototype.constructor = null; This of course failed silently and horribly in Safari -- but nobody noticed. Only later during the exploit-finding, when we realized that their strategy for preventing access to Facebook-internal methods (fbjs_event being one, if I remember correctly) was in each constructor to assign |this.constructor = null;|, was it discovered this didn't work in Safari. In the end the solution was to ban accessing the constructor property of any object, ever -- through translation-time changes when possible, and through runtime checks of property accesses when not. (This was already necessary for __defineGetter__, __defineSetter__, __proto__, caller, and several other properties, so it wasn't onerous, but it *was* unnecessary.) Either having constructor be deletable or mutable -- either one -- would have fixed this problem and allowed the constructor property to be safely exposed (assuming proper vigilance by Facebook in removing the constructor from their own functions, when needed). Real-world code relied (probably not based on a spec reading, but whatever) on changing/removing the constructor property from JS objects for security, and it was broken by this bug. This bug report was the result of email conversation with Facebook's security people after they discovered the problem; I didn't think it a great idea to be explicit about what the problem was as they hadn't fixed the problem at the time, so I hand-waved a bit and claimed this was only important "as an internals-hiding mechanism", but that wasn't really the whole story. 69868 11 darin 2008-02-08 15:28:16 -0800 (In reply to comment #10) > For the record, since I recently heard skepticism expressed on IRC over the > value of this: I think you probably misunderstood what you overheard. Maciej and I were joking about our responsibilities at Apple. It wasn't about the importance of this particular bug at all. 69869 12 darin 2008-02-08 15:30:02 -0800 (In reply to comment #9) > The reason I included the Node test was that I wanted to test at least one > auto-generated example. I agree that we could expand the test to make sure it > tests all the other generated constructors too. By "the Node test", I mean the test case that uses a Text node. 69877 13 darin 2008-02-08 17:06:43 -0800 Committed revision 30102. 19003 2008-02-08 03:52:56 -0800 2008-02-08 14:09:48 -0800 patch ConstructorAttributesPatch.txt text/plain 12669 darin SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDMwMDkwKQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjAgQEAKKzIwMDgtMDItMDggIERhcmluIEFk bGVyICA8ZGFyaW5AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgIC0gZml4IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTE1MDAzCisgICAgICAgICAgRnVuY3Rpb24ucHJvdG90eXBlLmNvbnN0cnVjdG9yIHNob3Vs ZCBub3QgYmUgRG9udERlbGV0ZS9SZWFkT25seSAoQWNpZDMgYnVnKQorCisgICAgICAgIFRlc3Q6 IGZhc3QvanMvY29uc3RydWN0b3ItYXR0cmlidXRlcy5odG1sCisKKyAgICAgICAgKiBranMvSlNH bG9iYWxPYmplY3QuY3BwOgorICAgICAgICAoS0pTOjpKU0dsb2JhbE9iamVjdDo6cmVzZXQpOiBS ZW1vdmUgdW53YW50ZWQgYXR0cmlidXRlcyBmcm9tICJjb25zdHJ1Y3RvciIuCisgICAgICAgICog a2pzL2Z1bmN0aW9uX29iamVjdC5jcHA6CisgICAgICAgIChLSlM6OkZ1bmN0aW9uT2JqZWN0SW1w Ojpjb25zdHJ1Y3QpOiBEaXR0by4KKyAgICAgICAgKiBranMvbm9kZXMuY3BwOgorICAgICAgICAo S0pTOjpGdW5jRGVjbE5vZGU6Om1ha2VGdW5jdGlvbik6IERpdHRvLgorICAgICAgICAoS0pTOjpG dW5jRXhwck5vZGU6OmV2YWx1YXRlKTogRGl0dG8uCisKIDIwMDgtMDItMDYgIEdlb2ZmcmV5IEdh cmVuICA8Z2dhcmVuQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBPbGl2ZXIgSHVu dC4KSW5kZXg6IEphdmFTY3JpcHRDb3JlL2tqcy9KU0dsb2JhbE9iamVjdC5jcHAKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gSmF2YVNjcmlwdENvcmUva2pzL0pTR2xvYmFsT2JqZWN0LmNwcAkocmV2aXNpb24gMzAw ODgpCisrKyBKYXZhU2NyaXB0Q29yZS9ranMvSlNHbG9iYWxPYmplY3QuY3BwCSh3b3JraW5nIGNv cHkpCkBAIC0yNjEsMjEgKzI2MSwyMSBAQCB2b2lkIEpTR2xvYmFsT2JqZWN0OjpyZXNldChKU1Zh bHVlKiBwcm90CiAgICAgCiAgICAgZCgpLT5mdW5jdGlvblByb3RvdHlwZS0+cHV0RGlyZWN0KGV4 ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5mdW5jdGlvbkNvbnN0cnVjdG9y LCBEb250RW51bSk7CiAKLSAgICBkKCktPm9iamVjdFByb3RvdHlwZS0+cHV0RGlyZWN0KGV4ZWMt PnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5vYmplY3RDb25zdHJ1Y3RvciwgRG9u dEVudW0gfCBEb250RGVsZXRlIHwgUmVhZE9ubHkpOwotICAgIGQoKS0+ZnVuY3Rpb25Qcm90b3R5 cGUtPnB1dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3RydWN0b3IsIGQoKS0+ZnVu Y3Rpb25Db25zdHJ1Y3RvciwgRG9udEVudW0gfCBEb250RGVsZXRlIHwgUmVhZE9ubHkpOwotICAg IGQoKS0+YXJyYXlQcm90b3R5cGUtPnB1dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29u c3RydWN0b3IsIGQoKS0+YXJyYXlDb25zdHJ1Y3RvciwgRG9udEVudW0gfCBEb250RGVsZXRlIHwg UmVhZE9ubHkpOwotICAgIGQoKS0+Ym9vbGVhblByb3RvdHlwZS0+cHV0RGlyZWN0KGV4ZWMtPnBy b3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5ib29sZWFuQ29uc3RydWN0b3IsIERvbnRF bnVtIHwgRG9udERlbGV0ZSB8IFJlYWRPbmx5KTsKLSAgICBkKCktPnN0cmluZ1Byb3RvdHlwZS0+ cHV0RGlyZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5zdHJpbmdD b25zdHJ1Y3RvciwgRG9udEVudW0gfCBEb250RGVsZXRlIHwgUmVhZE9ubHkpOwotICAgIGQoKS0+ bnVtYmVyUHJvdG90eXBlLT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlOYW1lcygpLmNvbnN0cnVj dG9yLCBkKCktPm51bWJlckNvbnN0cnVjdG9yLCBEb250RW51bSB8IERvbnREZWxldGUgfCBSZWFk T25seSk7Ci0gICAgZCgpLT5kYXRlUHJvdG90eXBlLT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlO YW1lcygpLmNvbnN0cnVjdG9yLCBkKCktPmRhdGVDb25zdHJ1Y3RvciwgRG9udEVudW0gfCBEb250 RGVsZXRlIHwgUmVhZE9ubHkpOwotICAgIGQoKS0+cmVnRXhwUHJvdG90eXBlLT5wdXREaXJlY3Qo ZXhlYy0+cHJvcGVydHlOYW1lcygpLmNvbnN0cnVjdG9yLCBkKCktPnJlZ0V4cENvbnN0cnVjdG9y LCBEb250RW51bSB8IERvbnREZWxldGUgfCBSZWFkT25seSk7Ci0gICAgZCgpLT5lcnJvclByb3Rv dHlwZS0+cHV0RGlyZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5l cnJvckNvbnN0cnVjdG9yLCBEb250RW51bSB8IERvbnREZWxldGUgfCBSZWFkT25seSk7Ci0gICAg ZCgpLT5ldmFsRXJyb3JQcm90b3R5cGUtPnB1dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCku Y29uc3RydWN0b3IsIGQoKS0+ZXZhbEVycm9yQ29uc3RydWN0b3IsIERvbnRFbnVtIHwgRG9udERl bGV0ZSB8IFJlYWRPbmx5KTsKLSAgICBkKCktPnJhbmdlRXJyb3JQcm90b3R5cGUtPnB1dERpcmVj dChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3RydWN0b3IsIGQoKS0+cmFuZ2VFcnJvckNvbnN0 cnVjdG9yLCBEb250RW51bSB8IERvbnREZWxldGUgfCBSZWFkT25seSk7Ci0gICAgZCgpLT5yZWZl cmVuY2VFcnJvclByb3RvdHlwZS0+cHV0RGlyZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25z dHJ1Y3RvciwgZCgpLT5yZWZlcmVuY2VFcnJvckNvbnN0cnVjdG9yLCBEb250RW51bSB8IERvbnRE ZWxldGUgfCBSZWFkT25seSk7Ci0gICAgZCgpLT5zeW50YXhFcnJvclByb3RvdHlwZS0+cHV0RGly ZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5zeW50YXhFcnJvckNv bnN0cnVjdG9yLCBEb250RW51bSB8IERvbnREZWxldGUgfCBSZWFkT25seSk7Ci0gICAgZCgpLT50 eXBlRXJyb3JQcm90b3R5cGUtPnB1dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3Ry dWN0b3IsIGQoKS0+dHlwZUVycm9yQ29uc3RydWN0b3IsIERvbnRFbnVtIHwgRG9udERlbGV0ZSB8 IFJlYWRPbmx5KTsKLSAgICBkKCktPlVSSUVycm9yUHJvdG90eXBlLT5wdXREaXJlY3QoZXhlYy0+ cHJvcGVydHlOYW1lcygpLmNvbnN0cnVjdG9yLCBkKCktPlVSSUVycm9yQ29uc3RydWN0b3IsIERv bnRFbnVtIHwgRG9udERlbGV0ZSB8IFJlYWRPbmx5KTsKKyAgICBkKCktPm9iamVjdFByb3RvdHlw ZS0+cHV0RGlyZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5vYmpl Y3RDb25zdHJ1Y3RvciwgRG9udEVudW0pOworICAgIGQoKS0+ZnVuY3Rpb25Qcm90b3R5cGUtPnB1 dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3RydWN0b3IsIGQoKS0+ZnVuY3Rpb25D b25zdHJ1Y3RvciwgRG9udEVudW0pOworICAgIGQoKS0+YXJyYXlQcm90b3R5cGUtPnB1dERpcmVj dChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3RydWN0b3IsIGQoKS0+YXJyYXlDb25zdHJ1Y3Rv ciwgRG9udEVudW0pOworICAgIGQoKS0+Ym9vbGVhblByb3RvdHlwZS0+cHV0RGlyZWN0KGV4ZWMt PnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5ib29sZWFuQ29uc3RydWN0b3IsIERv bnRFbnVtKTsKKyAgICBkKCktPnN0cmluZ1Byb3RvdHlwZS0+cHV0RGlyZWN0KGV4ZWMtPnByb3Bl cnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5zdHJpbmdDb25zdHJ1Y3RvciwgRG9udEVudW0p OworICAgIGQoKS0+bnVtYmVyUHJvdG90eXBlLT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlOYW1l cygpLmNvbnN0cnVjdG9yLCBkKCktPm51bWJlckNvbnN0cnVjdG9yLCBEb250RW51bSk7CisgICAg ZCgpLT5kYXRlUHJvdG90eXBlLT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlOYW1lcygpLmNvbnN0 cnVjdG9yLCBkKCktPmRhdGVDb25zdHJ1Y3RvciwgRG9udEVudW0pOworICAgIGQoKS0+cmVnRXhw UHJvdG90eXBlLT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlOYW1lcygpLmNvbnN0cnVjdG9yLCBk KCktPnJlZ0V4cENvbnN0cnVjdG9yLCBEb250RW51bSk7CisgICAgZCgpLT5lcnJvclByb3RvdHlw ZS0+cHV0RGlyZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5lcnJv ckNvbnN0cnVjdG9yLCBEb250RW51bSk7CisgICAgZCgpLT5ldmFsRXJyb3JQcm90b3R5cGUtPnB1 dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3RydWN0b3IsIGQoKS0+ZXZhbEVycm9y Q29uc3RydWN0b3IsIERvbnRFbnVtKTsKKyAgICBkKCktPnJhbmdlRXJyb3JQcm90b3R5cGUtPnB1 dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3RydWN0b3IsIGQoKS0+cmFuZ2VFcnJv ckNvbnN0cnVjdG9yLCBEb250RW51bSk7CisgICAgZCgpLT5yZWZlcmVuY2VFcnJvclByb3RvdHlw ZS0+cHV0RGlyZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgpLT5yZWZl cmVuY2VFcnJvckNvbnN0cnVjdG9yLCBEb250RW51bSk7CisgICAgZCgpLT5zeW50YXhFcnJvclBy b3RvdHlwZS0+cHV0RGlyZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZCgp LT5zeW50YXhFcnJvckNvbnN0cnVjdG9yLCBEb250RW51bSk7CisgICAgZCgpLT50eXBlRXJyb3JQ cm90b3R5cGUtPnB1dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3RydWN0b3IsIGQo KS0+dHlwZUVycm9yQ29uc3RydWN0b3IsIERvbnRFbnVtKTsKKyAgICBkKCktPlVSSUVycm9yUHJv dG90eXBlLT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlOYW1lcygpLmNvbnN0cnVjdG9yLCBkKCkt PlVSSUVycm9yQ29uc3RydWN0b3IsIERvbnRFbnVtKTsKIAogICAgIC8vIFNldCBnbG9iYWwgY29u c3RydWN0b3JzCiAKSW5kZXg6IEphdmFTY3JpcHRDb3JlL2tqcy9mdW5jdGlvbl9vYmplY3QuY3Bw Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIEphdmFTY3JpcHRDb3JlL2tqcy9mdW5jdGlvbl9vYmplY3QuY3BwCShy ZXZpc2lvbiAzMDA4OCkKKysrIEphdmFTY3JpcHRDb3JlL2tqcy9mdW5jdGlvbl9vYmplY3QuY3Bw CSh3b3JraW5nIGNvcHkpCkBAIC0yMjQsNyArMjI0LDcgQEAgSlNPYmplY3QqIEZ1bmN0aW9uT2Jq ZWN0SW1wOjpjb25zdHJ1Y3QoRQogCiAgICAgSlNPYmplY3QqIG9iakNvbnMgPSBleGVjLT5sZXhp Y2FsR2xvYmFsT2JqZWN0KCktPm9iamVjdENvbnN0cnVjdG9yKCk7CiAgICAgSlNPYmplY3QqIHBy b3RvdHlwZSA9IG9iakNvbnMtPmNvbnN0cnVjdChleGVjLCBleGVjLT5lbXB0eUxpc3QoKSk7Ci0g ICAgcHJvdG90eXBlLT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlOYW1lcygpLmNvbnN0cnVjdG9y LCBmaW1wLCBEb250RW51bSB8IERvbnREZWxldGUgfCBSZWFkT25seSk7CisgICAgcHJvdG90eXBl LT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlOYW1lcygpLmNvbnN0cnVjdG9yLCBmaW1wLCBEb250 RW51bSk7CiAgICAgZmltcC0+cHV0RGlyZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5wcm90b3R5 cGUsIHByb3RvdHlwZSwgSW50ZXJuYWwgfCBEb250RGVsZXRlKTsKICAgICByZXR1cm4gZmltcDsK IH0KSW5kZXg6IEphdmFTY3JpcHRDb3JlL2tqcy9ub2Rlcy5jcHAKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSmF2 YVNjcmlwdENvcmUva2pzL25vZGVzLmNwcAkocmV2aXNpb24gMzAwODgpCisrKyBKYXZhU2NyaXB0 Q29yZS9ranMvbm9kZXMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00NjY5LDcgKzQ2NjksNyBAQCBG dW5jdGlvbkltcCogRnVuY0RlY2xOb2RlOjptYWtlRnVuY3Rpb24oCiAgICAgRnVuY3Rpb25JbXAq IGZ1bmMgPSBuZXcgRnVuY3Rpb25JbXAoZXhlYywgbV9pZGVudCwgbV9ib2R5LmdldCgpLCBleGVj LT5zY29wZUNoYWluKCkpOwogCiAgICAgSlNPYmplY3QqIHByb3RvID0gZXhlYy0+bGV4aWNhbEds b2JhbE9iamVjdCgpLT5vYmplY3RDb25zdHJ1Y3RvcigpLT5jb25zdHJ1Y3QoZXhlYywgZXhlYy0+ ZW1wdHlMaXN0KCkpOwotICAgIHByb3RvLT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlOYW1lcygp LmNvbnN0cnVjdG9yLCBmdW5jLCBSZWFkT25seSB8IERvbnREZWxldGUgfCBEb250RW51bSk7Cisg ICAgcHJvdG8tPnB1dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3RydWN0b3IsIGZ1 bmMsIERvbnRFbnVtKTsKICAgICBmdW5jLT5wdXREaXJlY3QoZXhlYy0+cHJvcGVydHlOYW1lcygp LnByb3RvdHlwZSwgcHJvdG8sIEludGVybmFsIHwgRG9udERlbGV0ZSk7CiAgICAgZnVuYy0+cHV0 RGlyZWN0KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5sZW5ndGgsIGpzTnVtYmVyKG1fYm9keS0+cGFy YW1ldGVycygpLnNpemUoKSksIFJlYWRPbmx5IHwgRG9udERlbGV0ZSB8IERvbnRFbnVtKTsKICAg ICByZXR1cm4gZnVuYzsKQEAgLTQ3MDYsNyArNDcwNiw3IEBAIEpTVmFsdWUqIEZ1bmNFeHByTm9k ZTo6ZXZhbHVhdGUoRXhlY1N0YXQKIAogICAgIEZ1bmN0aW9uSW1wKiBmdW5jID0gbmV3IEZ1bmN0 aW9uSW1wKGV4ZWMsIG1faWRlbnQsIG1fYm9keS5nZXQoKSwgZXhlYy0+c2NvcGVDaGFpbigpKTsK ICAgICBKU09iamVjdCogcHJvdG8gPSBleGVjLT5sZXhpY2FsR2xvYmFsT2JqZWN0KCktPm9iamVj dENvbnN0cnVjdG9yKCktPmNvbnN0cnVjdChleGVjLCBleGVjLT5lbXB0eUxpc3QoKSk7Ci0gICAg cHJvdG8tPnB1dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkuY29uc3RydWN0b3IsIGZ1bmMs IFJlYWRPbmx5IHwgRG9udERlbGV0ZSB8IERvbnRFbnVtKTsKKyAgICBwcm90by0+cHV0RGlyZWN0 KGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5jb25zdHJ1Y3RvciwgZnVuYywgRG9udEVudW0pOwogICAg IGZ1bmMtPnB1dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkucHJvdG90eXBlLCBwcm90bywg SW50ZXJuYWwgfCBEb250RGVsZXRlKTsKIAogICAgIGlmIChuYW1lZCkgewpJbmRleDogV2ViQ29y ZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDMw MDkwKQorKysgV2ViQ29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxNCBA QAorMjAwOC0wMi0wOCAgRGFyaW4gQWRsZXIgIDxkYXJpbkBhcHBsZS5jb20+CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgLSBmaXggaHR0cDovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTUwMDMKKyAgICAgICAgICBGdW5jdGlvbi5wcm90 b3R5cGUuY29uc3RydWN0b3Igc2hvdWxkIG5vdCBiZSBEb250RGVsZXRlL1JlYWRPbmx5IChBY2lk MyBidWcpCisKKyAgICAgICAgVGVzdDogZmFzdC9qcy9jb25zdHJ1Y3Rvci1hdHRyaWJ1dGVzLmh0 bWwKKworICAgICAgICAqIGJpbmRpbmdzL3NjcmlwdHMvQ29kZUdlbmVyYXRvckpTLnBtOiBSZW1v dmUgdW53YW50ZWQgYXR0cmlidXRlcyBmcm9tICJjb25zdHJ1Y3RvciIuCisKIDIwMDgtMDItMDgg IFBpZXJyZS1MdWMgQmVhdWRvaW4gIDxwaWVycmUtbHVjLmJlYXVkb2luQGNvbGxhYm9yYS5jby51 az4KIAogICAgICAgICBSZXZpZXdlZCBieSBBbHAgVG9rZXIuCkluZGV4OiBXZWJDb3JlL2JpbmRp bmdzL3NjcmlwdHMvQ29kZUdlbmVyYXRvckpTLnBtCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvYmlu ZGluZ3Mvc2NyaXB0cy9Db2RlR2VuZXJhdG9ySlMucG0JKHJldmlzaW9uIDMwMDg5KQorKysgV2Vi Q29yZS9iaW5kaW5ncy9zY3JpcHRzL0NvZGVHZW5lcmF0b3JKUy5wbQkod29ya2luZyBjb3B5KQpA QCAtNjM3LDcgKzYzNyw3IEBAIHN1YiBHZW5lcmF0ZUltcGxlbWVudGF0aW9uCiAgICAgICAgIGlm ICgkZGF0YU5vZGUtPmV4dGVuZGVkQXR0cmlidXRlcy0+eyJHZW5lcmF0ZUNvbnN0cnVjdG9yIn0p IHsKICAgICAgICAgICAgIHB1c2goQGhhc2hLZXlzLCAiY29uc3RydWN0b3IiKTsKICAgICAgICAg ICAgIHB1c2goQGhhc2hWYWx1ZXMsICRjbGFzc05hbWUgLiAiOjpDb25zdHJ1Y3RvckF0dHJOdW0i KTsKLSAgICAgICAgICAgIHB1c2goQGhhc2hTcGVjaWFscywgIkRvbnREZWxldGV8RG9udEVudW18 UmVhZE9ubHkiKTsKKyAgICAgICAgICAgIHB1c2goQGhhc2hTcGVjaWFscywgIkRvbnRFbnVtIik7 CiAgICAgICAgICAgICBwdXNoKEBoYXNoUGFyYW1ldGVycywgIjAiKTsKICAgICAgICAgfQogCklu ZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hh bmdlTG9nCShyZXZpc2lvbiAzMDA5MCkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDA4LTAyLTA4ICBEYXJpbiBBZGxlciAgPGRhcmlu QGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAg ICAgICAtIHRlc3QgZm9yIGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE1 MDAzCisgICAgICAgICAgRnVuY3Rpb24ucHJvdG90eXBlLmNvbnN0cnVjdG9yIHNob3VsZCBub3Qg YmUgRG9udERlbGV0ZS9SZWFkT25seSAoQWNpZDMgYnVnKQorCisgICAgICAgICogZmFzdC9qcy9j b25zdHJ1Y3Rvci1hdHRyaWJ1dGVzLmh0bWw6IEFkZGVkLgorICAgICAgICAqIGZhc3QvanMvcmVz b3VyY2VzL2NvbnN0cnVjdG9yLWF0dHJpYnV0ZXMuanM6IEFkZGVkLgorCiAyMDA4LTAyLTA4ICBE YXJpbiBBZGxlciAgPGRhcmluQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBFcmlj LgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9qcy9jb25zdHJ1Y3Rvci1hdHRyaWJ1dGVzLmh0bWwK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9qcy9jb25zdHJ1Y3Rvci1hdHRyaWJ1dGVz Lmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2pzL2NvbnN0cnVjdG9yLWF0 dHJpYnV0ZXMuaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwxMyBAQAorPCFET0NUWVBFIEhU TUwgUFVCTElDICItLy9JRVRGLy9EVEQgSFRNTC8vRU4iPgorPGh0bWw+Cis8aGVhZD4KKzxsaW5r IHJlbD0ic3R5bGVzaGVldCIgaHJlZj0icmVzb3VyY2VzL2pzLXRlc3Qtc3R5bGUuY3NzIj4KKzxz Y3JpcHQgc3JjPSJyZXNvdXJjZXMvanMtdGVzdC1wcmUuanMiPjwvc2NyaXB0PgorPC9oZWFkPgor PGJvZHk+Cis8cCBpZD0iZGVzY3JpcHRpb24iPjwvcD4KKzxkaXYgaWQ9ImNvbnNvbGUiPjwvZGl2 PgorPHNjcmlwdCBzcmM9InJlc291cmNlcy9jb25zdHJ1Y3Rvci1hdHRyaWJ1dGVzLmpzIj48L3Nj cmlwdD4KKzxzY3JpcHQgc3JjPSJyZXNvdXJjZXMvanMtdGVzdC1wb3N0LmpzIj48L3NjcmlwdD4K KzwvYm9keT4KKzwvaHRtbD4KClByb3BlcnR5IGNoYW5nZXMgb246IExheW91dFRlc3RzL2Zhc3Qv anMvY29uc3RydWN0b3ItYXR0cmlidXRlcy5odG1sCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTmFtZTogc3ZuOm1pbWUt dHlwZQogICArIHRleHQvaHRtbApOYW1lOiBzdm46ZW9sLXN0eWxlCiAgICsgbmF0aXZlCgpJbmRl eDogTGF5b3V0VGVzdHMvZmFzdC9qcy9yZXNvdXJjZXMvY29uc3RydWN0b3ItYXR0cmlidXRlcy5q cwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2pzL3Jlc291cmNlcy9jb25zdHJ1Y3Rv ci1hdHRyaWJ1dGVzLmpzCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9qcy9yZXNv dXJjZXMvY29uc3RydWN0b3ItYXR0cmlidXRlcy5qcwkocmV2aXNpb24gMCkKQEAgLTAsMCArMSw0 NCBAQAorZGVzY3JpcHRpb24oCisiVGhpcyB0ZXN0IGNoZWNrcyB0aGF0IGNvbnN0cnVjdG9yIHBy b3BlcnRpZXMgYXJlIG5vdCBlbnVtZXJhdGFibGUsIGJ1dCBhcmUgd3JpdGFibGUgZGVsZXRhYmxl LiIKKyk7CisKK2Z1bmN0aW9uIGNhbkVudW0ob2JqZWN0LCBwcm9wZXJ0eU5hbWUpCit7CisgICAg Zm9yIChwcm9wIGluIG9iamVjdCkKKyAgICAgICAgaWYgKHByb3AgPT0gcHJvcGVydHlOYW1lKQor ICAgICAgICAgICAgcmV0dXJuIHRydWU7CisgICAgcmV0dXJuIGZhbHNlOworfQorCitmdW5jdGlv biBjaGVja0NvbnN0cnVjdG9yKGV4cHJlc3Npb24pCit7CisgICAgc2hvdWxkQmUoZXhwcmVzc2lv biArICIuaGFzT3duUHJvcGVydHkoJ2NvbnN0cnVjdG9yJykiLCAidHJ1ZSIpOworICAgIHNob3Vs ZEJlKCJjYW5FbnVtKCIgKyBleHByZXNzaW9uICsgIiwgJ2NvbnN0cnVjdG9yJykiLCAiZmFsc2Ui KTsKKyAgICBzaG91bGRCZSgieCA9ICIgKyBleHByZXNzaW9uICsgIjsgeC5jb25zdHJ1Y3RvciA9 IDQ7IHguY29uc3RydWN0b3IiLCAiNCIpOworICAgIHNob3VsZEJlKCJ4ID0gIiArIGV4cHJlc3Np b24gKyAiOyBkZWxldGUgeC5jb25zdHJ1Y3RvcjsgeC5oYXNPd25Qcm9wZXJ0eSgnY29uc3RydWN0 b3InKSIsICJmYWxzZSIpOworfQorCitjaGVja0NvbnN0cnVjdG9yKCIoZnVuY3Rpb24gKCkgeyB9 KS5wcm90b3R5cGUiKTsKK2Z1bmN0aW9uIGRlY2xhcmVkRnVuY3Rpb24oKSB7IH0KK2NoZWNrQ29u c3RydWN0b3IoImRlY2xhcmVkRnVuY3Rpb24ucHJvdG90eXBlIik7CitjaGVja0NvbnN0cnVjdG9y KCIobmV3IEZ1bmN0aW9uKS5wcm90b3R5cGUiKTsKKworY2hlY2tDb25zdHJ1Y3RvcigiQXJyYXku cHJvdG90eXBlIik7CitjaGVja0NvbnN0cnVjdG9yKCJCb29sZWFuLnByb3RvdHlwZSIpOworY2hl Y2tDb25zdHJ1Y3RvcigiRGF0ZS5wcm90b3R5cGUiKTsKK2NoZWNrQ29uc3RydWN0b3IoIkVycm9y LnByb3RvdHlwZSIpOworY2hlY2tDb25zdHJ1Y3RvcigiRXZhbEVycm9yLnByb3RvdHlwZSIpOwor Y2hlY2tDb25zdHJ1Y3RvcigiRnVuY3Rpb24ucHJvdG90eXBlIik7CitjaGVja0NvbnN0cnVjdG9y KCJOdW1iZXIucHJvdG90eXBlIik7CitjaGVja0NvbnN0cnVjdG9yKCJPYmplY3QucHJvdG90eXBl Iik7CitjaGVja0NvbnN0cnVjdG9yKCJSYW5nZUVycm9yLnByb3RvdHlwZSIpOworY2hlY2tDb25z dHJ1Y3RvcigiUmVmZXJlbmNlRXJyb3IucHJvdG90eXBlIik7CitjaGVja0NvbnN0cnVjdG9yKCJS ZWdFeHAucHJvdG90eXBlIik7CitjaGVja0NvbnN0cnVjdG9yKCJTdHJpbmcucHJvdG90eXBlIik7 CitjaGVja0NvbnN0cnVjdG9yKCJTeW50YXhFcnJvci5wcm90b3R5cGUiKTsKK2NoZWNrQ29uc3Ry dWN0b3IoIlR5cGVFcnJvci5wcm90b3R5cGUiKTsKK2NoZWNrQ29uc3RydWN0b3IoIlVSSUVycm9y LnByb3RvdHlwZSIpOworCitjaGVja0NvbnN0cnVjdG9yKCJkb2N1bWVudC5jcmVhdGVUZXh0Tm9k ZSgnJykiKTsKKwordmFyIHN1Y2Nlc3NmdWxseVBhcnNlZCA9IHRydWU7CkluZGV4OiBMYXlvdXRU ZXN0cy90cmF2ZXJzYWwvZXhjZXB0aW9uLWZvcndhcmRpbmcuaHRtbAo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBM YXlvdXRUZXN0cy90cmF2ZXJzYWwvZXhjZXB0aW9uLWZvcndhcmRpbmcuaHRtbAkocmV2aXNpb24g MzAwODkpCisrKyBMYXlvdXRUZXN0cy90cmF2ZXJzYWwvZXhjZXB0aW9uLWZvcndhcmRpbmcuaHRt bAkod29ya2luZyBjb3B5KQpAQCAtMSwxMyArMSwxMyBAQAogPCFET0NUWVBFIEhUTUwgUFVCTElD ICItLy9JRVRGLy9EVEQgSFRNTC8vRU4iPgogPGh0bWw+CiA8aGVhZD4KLTxsaW5rIHJlbD0ic3R5 bGVzaGVldCIgaHJlZj0iLi4vZmFzdC9qcy9yZXNvdXJjZXMvanMtdGVzdC1zdHlsZS5jc3MiPgot PHNjcmlwdCBzcmM9Ii4uL2Zhc3QvanMvcmVzb3VyY2VzL2pzLXRlc3QtcHJlLmpzIj48L3Njcmlw dD4KKzxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0iLi4vLi4vZmFzdC9qcy9yZXNvdXJjZXMv anMtdGVzdC1zdHlsZS5jc3MiPgorPHNjcmlwdCBzcmM9Ii4uLy4uL2Zhc3QvanMvcmVzb3VyY2Vz L2pzLXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KIDwvaGVhZD4KIDxib2R5PgogPHAgaWQ9ImRlc2Ny aXB0aW9uIj48L3A+CiA8ZGl2IGlkPSJjb25zb2xlIj48L2Rpdj4KIDxzY3JpcHQgc3JjPSJyZXNv dXJjZXMvZXhjZXB0aW9uLWZvcndhcmRpbmcuanMiPjwvc2NyaXB0PgotPHNjcmlwdCBzcmM9Ii4u L2Zhc3QvanMvcmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9zY3JpcHQ+Cis8c2NyaXB0IHNy Yz0iLi4vLi4vZmFzdC9qcy9yZXNvdXJjZXMvanMtdGVzdC1wb3N0LmpzIj48L3NjcmlwdD4KIDwv Ym9keT4KIDwvaHRtbD4K