112530 2013-03-17 21:01:00 -0700 [Shadow] offsetParent should never return nodes in user agent Shadow DOM to script 2013-03-18 08:55:18 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 dominicc dominicc abarth cmarcelo dglazkov esprehn+autocc esprehn morrita ojan.autocc webkit.review.bot oldest_to_newest 856815 0 dominicc 2013-03-17 21:01:00 -0700 There is a theoretical attack against user agent Shadow DOM where an attacker script uses offsetParent to grab a reference to a node in user agent Shadow DOM. This could be an information disclosure risk or could be used to induce a bad cast. The attack is theoretical, however to defend against this kind of attack, the offsetParent attribute should never return nodes in user agent Shadow DOM. In future this handling point could be generalized to checking that offsetParent is in the same tree scope as the element being queried, which will be useful for 'non traversable' shadows. 856816 1 193484 dominicc 2013-03-17 21:03:26 -0700 Created attachment 193484 Patch 856820 2 193484 esprehn 2013-03-17 21:16:46 -0700 Comment on attachment 193484 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=193484&action=review > Source/WebCore/dom/Element.cpp:539 > +Element* Element::bindingsOffsetParent() Could we just add an argument to offsetParent with enums like AllowUserAgentShadows and DisallowUserAgentShadows ? It's somewhat suspicious that platform code even uses offsetParent, I do see Blackberry and SpatialNavigation use it, but we have better methods for getting the absolute rect locations in the render tree. We should add a FIXME to eliminate all usage of offsetParent from C++ land. > Source/WebCore/dom/Element.cpp:542 > + if (!element) This might be nicer with the bitfield check like: if (!element || !element->isInShadowTree()) return element; return element->containingShadowRoot()->type() == ShadowRoot::UserAgentShadowRoot ? 0 : element; 856867 3 193494 dominicc 2013-03-18 00:13:25 -0700 Created attachment 193494 Patch 856868 4 193494 dominicc 2013-03-18 00:17:27 -0700 Comment on attachment 193494 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=193494&action=review > Source/WebCore/dom/Element.cpp:542 > + if (!element || !element->isInShadowTree()) Updated with different conditional structure suggested by esprehn. Although this code is vertically shorter, I think this is less readable. In particular, when non-traversable shadows are implemented, the original if-early return structure will have a neat diff. This will require the egg to first be unscrambled before it can be poached. > Source/WebCore/dom/Element.h:307 > + // FIXME: Replace uses of offsetParent in the platform with calls I think a separate method is easier to understand than an enum parameter with a default value which flips the behavior of the method. I agree that ultimately there should be simply one set of offset* methods used by the bindings. Reading RenderObject.h it isn't immediately clear what the equivalent method there is--absoluteBoundingBoxRectIgnoringTransforms? 856869 5 193494 esprehn 2013-03-18 00:18:28 -0700 Comment on attachment 193494 Patch LGTM. 856883 6 193494 webkit.review.bot 2013-03-18 00:57:50 -0700 Comment on attachment 193494 Patch Clearing flags on attachment: 193494 Committed r146037: <http://trac.webkit.org/changeset/146037> 856884 7 webkit.review.bot 2013-03-18 00:57:53 -0700 All reviewed patches have been landed. Closing bug. 857159 8 esprehn 2013-03-18 08:55:18 -0700 (In reply to comment #4) > (From update of attachment 193494 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=193494&action=review > > > Source/WebCore/dom/Element.cpp:542 > > + if (!element || !element->isInShadowTree()) > > Updated with different conditional structure suggested by esprehn. > > Although this code is vertically shorter, I think this is less readable. > > In particular, when non-traversable shadows are implemented, the original if-early return structure will have a neat diff. This will require the egg to first be unscrambled before it can be poached. You can go back to an if (element->containingShadowRoot()->type() == UserAgent) return 0; if you want. I meant it makes more sense to check isInShadowTree() in the first if and get rid of the extra null checks and locals. That's only one extra line as well. > > > Source/WebCore/dom/Element.h:307 > > + // FIXME: Replace uses of offsetParent in the platform with calls > > I think a separate method is easier to understand than an enum parameter with a default value which flips the behavior of the method. > > I agree that ultimately there should be simply one set of offset* methods used by the bindings. Reading RenderObject.h it isn't immediately clear what the equivalent method there is--absoluteBoundingBoxRectIgnoringTransforms? Probably something like Element::getBoundingClientRect. I don't know why you'd want to ignore transforms. 193484 2013-03-17 21:03:26 -0700 2013-03-18 00:13:21 -0700 Patch bug-112530-20130318125918.patch text/plain 6656 dominicc U3VidmVyc2lvbiBSZXZpc2lvbjogMTQ2MDI5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNzYxYTU5MTU0ZDhiYWI4 YTBhOWQyZjVmNDE3N2FlYjNkMjBiNWVjNy4uZjJhNjIwZGQ5MjRiM2FmY2Y2ZTgzYzFlM2FiYjEw MWQ5MjUxZjQ0MiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDEzLTAzLTE3ICBEb21p bmljIENvb25leSAgPGRvbWluaWNjQGNocm9taXVtLm9yZz4KKworICAgICAgICBbU2hhZG93XSBv ZmZzZXRQYXJlbnQgc2hvdWxkIG5ldmVyIHJldHVybiBub2RlcyBpbiB1c2VyIGFnZW50IFNoYWRv dyBET00gdG8gc2NyaXB0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xMTI1MzAKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICBUZXN0OiBmYXN0L2RvbS9zaGFkb3cvb2Zmc2V0LXBhcmVudC1kb2VzLW5vdC1sZWFr LXVhLXNoYWRvdy5odG1sCisKKyAgICAgICAgKiBkb20vRWxlbWVudC5jcHA6CisgICAgICAgIChX ZWJDb3JlOjpFbGVtZW50OjpiaW5kaW5nc09mZnNldFBhcmVudCk6IEZpbHRlciBub2RlcyBpbiBV QSBzaGFkb3dzLgorICAgICAgICAqIGRvbS9FbGVtZW50Lmg6CisgICAgICAgIChFbGVtZW50KTog QWRkIGJpbmRpbmdzT2Zmc2V0UGFyZW50LgorICAgICAgICAqIGRvbS9FbGVtZW50LmlkbDogYmlu ZGluZ3NPZmZzZXRQYXJlbnQgaXMgdGhlIGltcGxlbWVudGF0aW9uIG9mIG9mZnNldFBhcmVudC4K KwogMjAxMy0wMy0xNyAgS2VudCBUYW11cmEgIDx0a2VudEBjaHJvbWl1bS5vcmc+CiAKICAgICAg ICAgSU5QVVRfTVVMVElQTEVfRklFTERTX1VJOiBEb24ndCB1cGRhdGUgc2hhZG93IHRyZWUgYnkg dXBkYXRpbmcgYW55IGF0dHJpYnV0ZQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvZG9tL0Vs ZW1lbnQuY3BwIGIvU291cmNlL1dlYkNvcmUvZG9tL0VsZW1lbnQuY3BwCmluZGV4IGU0MzZjYmNj MjRlN2M2ZmNjYWRjZTU0MTNhN2VmNmE5MTg1ZjRjNzIuLjZiNGUyZmJmM2I0YmQ3ODRkYTBmM2U3 ZTJmNGNiODM1NTJhNWViMzkgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2RvbS9FbGVtZW50 LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9kb20vRWxlbWVudC5jcHAKQEAgLTUzNiw2ICs1MzYs MTkgQEAgaW50IEVsZW1lbnQ6Om9mZnNldEhlaWdodCgpCiAgICAgcmV0dXJuIDA7CiB9CiAKK0Vs ZW1lbnQqIEVsZW1lbnQ6OmJpbmRpbmdzT2Zmc2V0UGFyZW50KCkKK3sKKyAgICBFbGVtZW50KiBl bGVtZW50ID0gb2Zmc2V0UGFyZW50KCk7CisgICAgaWYgKCFlbGVtZW50KQorICAgICAgICByZXR1 cm4gMDsKKyAgICBTaGFkb3dSb290KiBzaGFkb3dSb290ID0gZWxlbWVudC0+Y29udGFpbmluZ1No YWRvd1Jvb3QoKTsKKyAgICBpZiAoIXNoYWRvd1Jvb3QpCisgICAgICAgIHJldHVybiBlbGVtZW50 OworICAgIGlmIChzaGFkb3dSb290LT50eXBlKCkgPT0gU2hhZG93Um9vdDo6VXNlckFnZW50U2hh ZG93Um9vdCkKKyAgICAgICAgcmV0dXJuIDA7CisgICAgcmV0dXJuIGVsZW1lbnQ7Cit9CisKIEVs ZW1lbnQqIEVsZW1lbnQ6Om9mZnNldFBhcmVudCgpCiB7CiAgICAgZG9jdW1lbnQoKS0+dXBkYXRl TGF5b3V0SWdub3JlUGVuZGluZ1N0eWxlc2hlZXRzKCk7CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2Vi Q29yZS9kb20vRWxlbWVudC5oIGIvU291cmNlL1dlYkNvcmUvZG9tL0VsZW1lbnQuaAppbmRleCA2 Y2E1YjIyMTdhYmU0MjI0NDMzYjc4ZGQ4OWZlYjY1MDMyZmFiNzQ5Li5iNzM0NThjZWExNTFmZjc3 MTExYjQ5NzBmNDFiZGFiN2U0ODc5ZDY5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20v RWxlbWVudC5oCisrKyBiL1NvdXJjZS9XZWJDb3JlL2RvbS9FbGVtZW50LmgKQEAgLTMwMyw2ICsz MDMsNyBAQCBwdWJsaWM6CiAgICAgaW50IG9mZnNldFRvcCgpOwogICAgIGludCBvZmZzZXRXaWR0 aCgpOwogICAgIGludCBvZmZzZXRIZWlnaHQoKTsKKyAgICBFbGVtZW50KiBiaW5kaW5nc09mZnNl dFBhcmVudCgpOwogICAgIEVsZW1lbnQqIG9mZnNldFBhcmVudCgpOwogICAgIGludCBjbGllbnRM ZWZ0KCk7CiAgICAgaW50IGNsaWVudFRvcCgpOwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUv ZG9tL0VsZW1lbnQuaWRsIGIvU291cmNlL1dlYkNvcmUvZG9tL0VsZW1lbnQuaWRsCmluZGV4IGZh YTczYTg2ZDJjMGYwMjVhZmY5Y2NlMWRlM2E3MDYzNDBiZmZjMWEuLjVkODNhZGVlYzEyYTg0MGFl ZDA0NDBmMWJjYTVkNzA1Y2E2MzQwM2EgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2RvbS9F bGVtZW50LmlkbAorKysgYi9Tb3VyY2UvV2ViQ29yZS9kb20vRWxlbWVudC5pZGwKQEAgLTc1LDcg Kzc1LDcgQEAKICAgICByZWFkb25seSBhdHRyaWJ1dGUgbG9uZyBvZmZzZXRUb3A7CiAgICAgcmVh ZG9ubHkgYXR0cmlidXRlIGxvbmcgb2Zmc2V0V2lkdGg7CiAgICAgcmVhZG9ubHkgYXR0cmlidXRl IGxvbmcgb2Zmc2V0SGVpZ2h0OwotICAgIHJlYWRvbmx5IGF0dHJpYnV0ZSBFbGVtZW50IG9mZnNl dFBhcmVudDsKKyAgICBbSW1wbGVtZW50ZWRBcz1iaW5kaW5nc09mZnNldFBhcmVudF0gcmVhZG9u bHkgYXR0cmlidXRlIEVsZW1lbnQgb2Zmc2V0UGFyZW50OwogICAgIHJlYWRvbmx5IGF0dHJpYnV0 ZSBsb25nIGNsaWVudExlZnQ7CiAgICAgcmVhZG9ubHkgYXR0cmlidXRlIGxvbmcgY2xpZW50VG9w OwogICAgIHJlYWRvbmx5IGF0dHJpYnV0ZSBsb25nIGNsaWVudFdpZHRoOwpkaWZmIC0tZ2l0IGEv TGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGU1ODNk OTM4M2NmMWMwNmRmMDFmNGRjMmVhMjg5NzAxMWE2NjFhOTQuLjRjODdkZDI2NzJjOWNmN2YwNmRl MTE4MmUyMjUxZjc0MGI5YzIwZDMgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZwor KysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAxMy0wMy0xNyAg RG9taW5pYyBDb29uZXkgIDxkb21pbmljY0BjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgW1NoYWRv d10gb2Zmc2V0UGFyZW50IHNob3VsZCBuZXZlciByZXR1cm4gbm9kZXMgaW4gdXNlciBhZ2VudCBT aGFkb3cgRE9NIHRvIHNjcmlwdAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MTEyNTMwCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgKiBmYXN0L2RvbS9zaGFkb3cvb2Zmc2V0LXBhcmVudC1kb2VzLW5vdC1sZWFr LXVhLXNoYWRvdy1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvZG9tL3NoYWRv dy9vZmZzZXQtcGFyZW50LWRvZXMtbm90LWxlYWstdWEtc2hhZG93Lmh0bWw6IEFkZGVkLgorCiAy MDEzLTAzLTE3ICBLZW50IFRhbXVyYSAgPHRrZW50QGNocm9taXVtLm9yZz4KIAogICAgICAgICBJ TlBVVF9NVUxUSVBMRV9GSUVMRFNfVUk6IERvbid0IHVwZGF0ZSBzaGFkb3cgdHJlZSBieSB1cGRh dGluZyBhbnkgYXR0cmlidXRlCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2RvbS9zaGFk b3cvb2Zmc2V0LXBhcmVudC1kb2VzLW5vdC1sZWFrLXVhLXNoYWRvdy1leHBlY3RlZC50eHQgYi9M YXlvdXRUZXN0cy9mYXN0L2RvbS9zaGFkb3cvb2Zmc2V0LXBhcmVudC1kb2VzLW5vdC1sZWFrLXVh LXNoYWRvdy1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uYmZkMDNlM2I1OTBmODQ5ZmYwYzgwMzQ1 NTUwNTNhZjU2ZTNhYzg1MgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvZG9t L3NoYWRvdy9vZmZzZXQtcGFyZW50LWRvZXMtbm90LWxlYWstdWEtc2hhZG93LWV4cGVjdGVkLnR4 dApAQCAtMCwwICsxLDEzIEBACitvZmZzZXRQYXJlbnQgc2hvdWxkIG5vdCBsZWFrIG5vZGVzIGlu IHVzZXIgYWdlbnQgU2hhZG93IERPTS4KKworT24gc3VjY2VzcywgeW91IHdpbGwgc2VlIGEgc2Vy aWVzIG9mICJQQVNTIiBtZXNzYWdlcywgZm9sbG93ZWQgYnkgIlRFU1QgQ09NUExFVEUiLgorCisK K1BBU1MgY2hpbGQub2Zmc2V0UGFyZW50IGlzIHNoYWRvdy5wb3NpdGlvbmVkRWxlbWVudAorUEFT UyBjaGlsZC5vZmZzZXRQYXJlbnQgaXMgY29udGFpbmVyCitQQVNTIGNoaWxkLm9mZnNldFBhcmVu dCBpcyBudWxsCitQQVNTIGNoaWxkLm9mZnNldFBhcmVudCBpcyBjb250YWluZXIKK1BBU1Mgc3Vj Y2Vzc2Z1bGx5UGFyc2VkIGlzIHRydWUKKworVEVTVCBDT01QTEVURQorCmRpZmYgLS1naXQgYS9M YXlvdXRUZXN0cy9mYXN0L2RvbS9zaGFkb3cvb2Zmc2V0LXBhcmVudC1kb2VzLW5vdC1sZWFrLXVh LXNoYWRvdy5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9kb20vc2hhZG93L29mZnNldC1wYXJlbnQt ZG9lcy1ub3QtbGVhay11YS1zaGFkb3cuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi43NWYyZmZjNjlhNDc1ZDgz NzJhMWE2NDkzNjRlNDkzYjY3Njg1YTI0Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMv ZmFzdC9kb20vc2hhZG93L29mZnNldC1wYXJlbnQtZG9lcy1ub3QtbGVhay11YS1zaGFkb3cuaHRt bApAQCAtMCwwICsxLDUyIEBACis8IURPQ1RZUEUgaHRtbD4KKzxzY3JpcHQgc3JjPSIuLi8uLi9q cy9yZXNvdXJjZXMvanMtdGVzdC1wcmUuanMiPjwvc2NyaXB0PgorPGJvZHk+Cis8ZGl2IGlkPSJj b250YWluZXIiIHN0eWxlPSJwb3NpdGlvbjogcmVsYXRpdmU7Ij48L2Rpdj4KKzxzY3JpcHQ+Citk ZXNjcmlwdGlvbignb2Zmc2V0UGFyZW50IHNob3VsZCBub3QgbGVhayBub2RlcyBpbiB1c2VyIGFn ZW50IFNoYWRvdyBET00uJyk7CisKK2lmICghd2luZG93LmludGVybmFscykKKyAgICBmYWlsKCdU aGlzIHRlc3QgcmVxdWlyZXMgd2luZG93LmludGVybmFscyB0byBtYW5pcHVsYXRlIHVzZXIgYWdl bnQgU2hhZG93IERPTS4nKTsKKworZnVuY3Rpb24gY29uZmlndXJlU2hhZG93Um9vdChzaGFkb3cp IHsKKyAgICBzaGFkb3cuaW5uZXJIVE1MID0KKyAgICAgICAgJzxkaXYgaWQ9IngiIHN0eWxlPSJw b3NpdGlvbjogcmVsYXRpdmU7Ij48Y29udGVudD48L2NvbnRlbnQ+PC9kaXY+JzsKKyAgICBzaGFk b3cucG9zaXRpb25lZEVsZW1lbnQgPSBzaGFkb3cucXVlcnlTZWxlY3RvcignI3gnKTsKK30KKwor dmFyIGNvbnRhaW5lciA9IGRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoJyNjb250YWluZXInKTsKKwor Ly8gVGVzdCB0aGF0IG9mZnNldFBhcmVudCB3b3JrcyBpbiBhdXRob3IgU2hhZG93IERPTQordmFy IGhvc3QgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdkaXYnKTsKK2NvbnRhaW5lci5hcHBlbmRD aGlsZChob3N0KTsKK3ZhciBjaGlsZCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2RpdicpOwor aG9zdC5hcHBlbmRDaGlsZChjaGlsZCk7Cit2YXIgc2hhZG93ID0gaG9zdC53ZWJraXRDcmVhdGVT aGFkb3dSb290KCk7Citjb25maWd1cmVTaGFkb3dSb290KHNoYWRvdyk7CitzaG91bGRCZSgnY2hp bGQub2Zmc2V0UGFyZW50JywgJ3NoYWRvdy5wb3NpdGlvbmVkRWxlbWVudCcpOworCisvLyBUZXN0 IHRoYXQgb2Zmc2V0UGFyZW50IHdvcmtzICd0aHJvdWdoJyBTaGFkb3cgRE9NIHdoZW4gdGhlcmUg aXMgbm8KKy8vIHBvc2l0aW9uZWQgYW5jZXN0b3IgaW4gdXNlciBhZ2VudCBTaGFkb3cgRE9NCitz aGFkb3cucG9zaXRpb25lZEVsZW1lbnQucmVtb3ZlQXR0cmlidXRlKCdzdHlsZScpOworc2hvdWxk QmUoJ2NoaWxkLm9mZnNldFBhcmVudCcsICdjb250YWluZXInKTsKKworLy8gVGVzdCB0aGF0IHdo ZW4gdGhlIG9mZnNldFBhcmVudCBpcyBpbiB1c2VyIGFnZW50IFNoYWRvdyBET00sIGl0IGlzCisv LyBub3QgZXhwb3NlZCB0byBzY3JpcHQKK2hvc3QgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdk ZXRhaWxzJyk7Citjb250YWluZXIuYXBwZW5kQ2hpbGQoaG9zdCk7Citob3N0LnNldEF0dHJpYnV0 ZSgnb3BlbicsICdvcGVuJyk7Citob3N0LmFwcGVuZENoaWxkKGNoaWxkKTsKK3ZhciBzaGFkb3cg PSB3aW5kb3cuaW50ZXJuYWxzLnlvdW5nZXN0U2hhZG93Um9vdChob3N0KTsgIC8vIHRoaXMgaXMg YSBVQSBzaGFkb3cgcm9vdAorY29uZmlndXJlU2hhZG93Um9vdChzaGFkb3cpOworc2hvdWxkQmUo J2NoaWxkLm9mZnNldFBhcmVudCcsICdudWxsJyk7CisKKy8vIFRlc3QgdGhhdCBvZmZzZXRQYXJl bnQgd29ya3MgJ3Rocm91Z2gnIHVzZXIgYWdlbnQgU2hhZG93IERPTSB3aGVuIHRoZXJlIGlzIG5v CisvLyBwb3NpdGlvbmVkIGFuY2VzdG9yIGluIHVzZXIgYWdlbnQgU2hhZG93IERPTQorc2hhZG93 LnBvc2l0aW9uZWRFbGVtZW50LnJlbW92ZUF0dHJpYnV0ZSgnc3R5bGUnKTsKK3Nob3VsZEJlKCdj aGlsZC5vZmZzZXRQYXJlbnQnLCAnY29udGFpbmVyJyk7CisKK2NvbnRhaW5lci5yZW1vdmUoKTsK Kworc3VjY2Vzc2Z1bGx5UGFyc2VkID0gdHJ1ZTsKKzwvc2NyaXB0PgorPHNjcmlwdCBzcmM9Ii4u Ly4uL2pzL3Jlc291cmNlcy9qcy10ZXN0LXBvc3QuanMiPjwvc2NyaXB0Pgo= 193494 2013-03-18 00:13:25 -0700 2013-03-18 00:57:50 -0700 Patch bug-112530-20130318160917.patch text/plain 6705 dominicc U3VidmVyc2lvbiBSZXZpc2lvbjogMTQ2MDM1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZjQ4NTBjYzQxNzM0NmVm MzA4OWVmMGE2NjUwZmNlNGQwODE2ZTI0Yy4uMjdiNGMwYmNjMjI0ZDVhOTYzODQ1OWU3MzhiZjE0 Y2JhMjdmNDA4MiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDEzLTAzLTE3ICBEb21p bmljIENvb25leSAgPGRvbWluaWNjQGNocm9taXVtLm9yZz4KKworICAgICAgICBbU2hhZG93XSBv ZmZzZXRQYXJlbnQgc2hvdWxkIG5ldmVyIHJldHVybiBub2RlcyBpbiB1c2VyIGFnZW50IFNoYWRv dyBET00gdG8gc2NyaXB0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xMTI1MzAKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICBUZXN0OiBmYXN0L2RvbS9zaGFkb3cvb2Zmc2V0LXBhcmVudC1kb2VzLW5vdC1sZWFr LXVhLXNoYWRvdy5odG1sCisKKyAgICAgICAgKiBkb20vRWxlbWVudC5jcHA6CisgICAgICAgIChX ZWJDb3JlOjpFbGVtZW50OjpiaW5kaW5nc09mZnNldFBhcmVudCk6IEZpbHRlciBub2RlcyBpbiBV QSBzaGFkb3dzLgorICAgICAgICAqIGRvbS9FbGVtZW50Lmg6CisgICAgICAgIChFbGVtZW50KTog QWRkIGJpbmRpbmdzT2Zmc2V0UGFyZW50LgorICAgICAgICAqIGRvbS9FbGVtZW50LmlkbDogYmlu ZGluZ3NPZmZzZXRQYXJlbnQgaXMgdGhlIGltcGxlbWVudGF0aW9uIG9mIG9mZnNldFBhcmVudC4K KwogMjAxMy0wMy0xNyAgRG9taW5pYyBNYXp6b25pICA8ZG1henpvbmlAZ29vZ2xlLmNvbT4KIAog ICAgICAgICBTdXBwb3J0IFdpbmRvd3MgSFRNTFNlbGVjdEVsZW1lbnQga2V5c3Ryb2tlcyBvbiBD aHJvbWl1bSB3aW4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2RvbS9FbGVtZW50LmNwcCBi L1NvdXJjZS9XZWJDb3JlL2RvbS9FbGVtZW50LmNwcAppbmRleCBlNDM2Y2JjYzI0ZTdjNmZjY2Fk Y2U1NDEzYTdlZjZhOTE4NWY0YzcyLi42ZTg5YzAxNWQ0YTBmYTU5YjcyNzMyNmVkN2JkMDJiZDMw MDhiZWVlIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vRWxlbWVudC5jcHAKKysrIGIv U291cmNlL1dlYkNvcmUvZG9tL0VsZW1lbnQuY3BwCkBAIC01MzYsNiArNTM2LDE0IEBAIGludCBF bGVtZW50OjpvZmZzZXRIZWlnaHQoKQogICAgIHJldHVybiAwOwogfQogCitFbGVtZW50KiBFbGVt ZW50OjpiaW5kaW5nc09mZnNldFBhcmVudCgpCit7CisgICAgRWxlbWVudCogZWxlbWVudCA9IG9m ZnNldFBhcmVudCgpOworICAgIGlmICghZWxlbWVudCB8fCAhZWxlbWVudC0+aXNJblNoYWRvd1Ry ZWUoKSkKKyAgICAgICAgcmV0dXJuIGVsZW1lbnQ7CisgICAgcmV0dXJuIGVsZW1lbnQtPmNvbnRh aW5pbmdTaGFkb3dSb290KCktPnR5cGUoKSA9PSBTaGFkb3dSb290OjpVc2VyQWdlbnRTaGFkb3dS b290ID8gMCA6IGVsZW1lbnQ7Cit9CisKIEVsZW1lbnQqIEVsZW1lbnQ6Om9mZnNldFBhcmVudCgp CiB7CiAgICAgZG9jdW1lbnQoKS0+dXBkYXRlTGF5b3V0SWdub3JlUGVuZGluZ1N0eWxlc2hlZXRz KCk7CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9kb20vRWxlbWVudC5oIGIvU291cmNlL1dl YkNvcmUvZG9tL0VsZW1lbnQuaAppbmRleCA2Y2E1YjIyMTdhYmU0MjI0NDMzYjc4ZGQ4OWZlYjY1 MDMyZmFiNzQ5Li45Y2E0YTU3MzI2MTEwMjg5M2MyYzE1MzA1NWZmMTZiMjY5ZDEzZmUxIDEwMDY0 NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vRWxlbWVudC5oCisrKyBiL1NvdXJjZS9XZWJDb3Jl L2RvbS9FbGVtZW50LmgKQEAgLTMwMyw2ICszMDMsMTEgQEAgcHVibGljOgogICAgIGludCBvZmZz ZXRUb3AoKTsKICAgICBpbnQgb2Zmc2V0V2lkdGgoKTsKICAgICBpbnQgb2Zmc2V0SGVpZ2h0KCk7 CisKKyAgICAvLyBGSVhNRTogUmVwbGFjZSB1c2VzIG9mIG9mZnNldFBhcmVudCBpbiB0aGUgcGxh dGZvcm0gd2l0aCBjYWxscworICAgIC8vIHRvIHRoZSByZW5kZXIgbGF5ZXIgYW5kIG1lcmdlIGJp bmRpbmdzT2Zmc2V0UGFyZW50IGFuZCBvZmZzZXRQYXJlbnQuCisgICAgRWxlbWVudCogYmluZGlu Z3NPZmZzZXRQYXJlbnQoKTsKKwogICAgIEVsZW1lbnQqIG9mZnNldFBhcmVudCgpOwogICAgIGlu dCBjbGllbnRMZWZ0KCk7CiAgICAgaW50IGNsaWVudFRvcCgpOwpkaWZmIC0tZ2l0IGEvU291cmNl L1dlYkNvcmUvZG9tL0VsZW1lbnQuaWRsIGIvU291cmNlL1dlYkNvcmUvZG9tL0VsZW1lbnQuaWRs CmluZGV4IGZhYTczYTg2ZDJjMGYwMjVhZmY5Y2NlMWRlM2E3MDYzNDBiZmZjMWEuLjVkODNhZGVl YzEyYTg0MGFlZDA0NDBmMWJjYTVkNzA1Y2E2MzQwM2EgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJD b3JlL2RvbS9FbGVtZW50LmlkbAorKysgYi9Tb3VyY2UvV2ViQ29yZS9kb20vRWxlbWVudC5pZGwK QEAgLTc1LDcgKzc1LDcgQEAKICAgICByZWFkb25seSBhdHRyaWJ1dGUgbG9uZyBvZmZzZXRUb3A7 CiAgICAgcmVhZG9ubHkgYXR0cmlidXRlIGxvbmcgb2Zmc2V0V2lkdGg7CiAgICAgcmVhZG9ubHkg YXR0cmlidXRlIGxvbmcgb2Zmc2V0SGVpZ2h0OwotICAgIHJlYWRvbmx5IGF0dHJpYnV0ZSBFbGVt ZW50IG9mZnNldFBhcmVudDsKKyAgICBbSW1wbGVtZW50ZWRBcz1iaW5kaW5nc09mZnNldFBhcmVu dF0gcmVhZG9ubHkgYXR0cmlidXRlIEVsZW1lbnQgb2Zmc2V0UGFyZW50OwogICAgIHJlYWRvbmx5 IGF0dHJpYnV0ZSBsb25nIGNsaWVudExlZnQ7CiAgICAgcmVhZG9ubHkgYXR0cmlidXRlIGxvbmcg Y2xpZW50VG9wOwogICAgIHJlYWRvbmx5IGF0dHJpYnV0ZSBsb25nIGNsaWVudFdpZHRoOwpkaWZm IC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmlu ZGV4IDcxOWZlOGU1NWVhZTZkMDk2ODNmMDQ0MDFiOTkzYTJhNTY2ZTVjZjQuLjUyYTVjN2Y4Zjkw MDAwZTBmZDNkNzBhZWYwYjQ5N2ZkZTc4YzkyMjMgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0No YW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAx My0wMy0xNyAgRG9taW5pYyBDb29uZXkgIDxkb21pbmljY0BjaHJvbWl1bS5vcmc+CisKKyAgICAg ICAgW1NoYWRvd10gb2Zmc2V0UGFyZW50IHNob3VsZCBuZXZlciByZXR1cm4gbm9kZXMgaW4gdXNl ciBhZ2VudCBTaGFkb3cgRE9NIHRvIHNjcmlwdAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTEyNTMwCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgKiBmYXN0L2RvbS9zaGFkb3cvb2Zmc2V0LXBhcmVudC1kb2Vz LW5vdC1sZWFrLXVhLXNoYWRvdy1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3Qv ZG9tL3NoYWRvdy9vZmZzZXQtcGFyZW50LWRvZXMtbm90LWxlYWstdWEtc2hhZG93Lmh0bWw6IEFk ZGVkLgorCiAyMDEzLTAzLTE3ICBTaW1vbiBGcmFzZXIgIDxzaW1vbi5mcmFzZXJAYXBwbGUuY29t PgogCiAgICAgICAgIE1hcmsgc29tZSBtb3JlIHRlc3RzIGFzIGZsYWtleSwgb3IgYXNzZXJ0aW5n IGluIGRlYnVnLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9kb20vc2hhZG93L29mZnNl dC1wYXJlbnQtZG9lcy1ub3QtbGVhay11YS1zaGFkb3ctZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVz dHMvZmFzdC9kb20vc2hhZG93L29mZnNldC1wYXJlbnQtZG9lcy1ub3QtbGVhay11YS1zaGFkb3ct ZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmJmZDAzZTNiNTkwZjg0OWZmMGM4MDM0NTU1MDUzYWY1 NmUzYWM4NTIKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2RvbS9zaGFkb3cv b2Zmc2V0LXBhcmVudC1kb2VzLW5vdC1sZWFrLXVhLXNoYWRvdy1leHBlY3RlZC50eHQKQEAgLTAs MCArMSwxMyBAQAorb2Zmc2V0UGFyZW50IHNob3VsZCBub3QgbGVhayBub2RlcyBpbiB1c2VyIGFn ZW50IFNoYWRvdyBET00uCisKK09uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAi UEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKworCitQQVNTIGNo aWxkLm9mZnNldFBhcmVudCBpcyBzaGFkb3cucG9zaXRpb25lZEVsZW1lbnQKK1BBU1MgY2hpbGQu b2Zmc2V0UGFyZW50IGlzIGNvbnRhaW5lcgorUEFTUyBjaGlsZC5vZmZzZXRQYXJlbnQgaXMgbnVs bAorUEFTUyBjaGlsZC5vZmZzZXRQYXJlbnQgaXMgY29udGFpbmVyCitQQVNTIHN1Y2Nlc3NmdWxs eVBhcnNlZCBpcyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz dHMvZmFzdC9kb20vc2hhZG93L29mZnNldC1wYXJlbnQtZG9lcy1ub3QtbGVhay11YS1zaGFkb3cu aHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvZG9tL3NoYWRvdy9vZmZzZXQtcGFyZW50LWRvZXMtbm90 LWxlYWstdWEtc2hhZG93Lmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uNzVmMmZmYzY5YTQ3NWQ4MzcyYTFhNjQ5 MzY0ZTQ5M2I2NzY4NWEyNAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvZG9t L3NoYWRvdy9vZmZzZXQtcGFyZW50LWRvZXMtbm90LWxlYWstdWEtc2hhZG93Lmh0bWwKQEAgLTAs MCArMSw1MiBAQAorPCFET0NUWVBFIGh0bWw+Cis8c2NyaXB0IHNyYz0iLi4vLi4vanMvcmVzb3Vy Y2VzL2pzLXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KKzxib2R5PgorPGRpdiBpZD0iY29udGFpbmVy IiBzdHlsZT0icG9zaXRpb246IHJlbGF0aXZlOyI+PC9kaXY+Cis8c2NyaXB0PgorZGVzY3JpcHRp b24oJ29mZnNldFBhcmVudCBzaG91bGQgbm90IGxlYWsgbm9kZXMgaW4gdXNlciBhZ2VudCBTaGFk b3cgRE9NLicpOworCitpZiAoIXdpbmRvdy5pbnRlcm5hbHMpCisgICAgZmFpbCgnVGhpcyB0ZXN0 IHJlcXVpcmVzIHdpbmRvdy5pbnRlcm5hbHMgdG8gbWFuaXB1bGF0ZSB1c2VyIGFnZW50IFNoYWRv dyBET00uJyk7CisKK2Z1bmN0aW9uIGNvbmZpZ3VyZVNoYWRvd1Jvb3Qoc2hhZG93KSB7CisgICAg c2hhZG93LmlubmVySFRNTCA9CisgICAgICAgICc8ZGl2IGlkPSJ4IiBzdHlsZT0icG9zaXRpb246 IHJlbGF0aXZlOyI+PGNvbnRlbnQ+PC9jb250ZW50PjwvZGl2Pic7CisgICAgc2hhZG93LnBvc2l0 aW9uZWRFbGVtZW50ID0gc2hhZG93LnF1ZXJ5U2VsZWN0b3IoJyN4Jyk7Cit9CisKK3ZhciBjb250 YWluZXIgPSBkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCcjY29udGFpbmVyJyk7CisKKy8vIFRlc3Qg dGhhdCBvZmZzZXRQYXJlbnQgd29ya3MgaW4gYXV0aG9yIFNoYWRvdyBET00KK3ZhciBob3N0ID0g ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnZGl2Jyk7Citjb250YWluZXIuYXBwZW5kQ2hpbGQoaG9z dCk7Cit2YXIgY2hpbGQgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdkaXYnKTsKK2hvc3QuYXBw ZW5kQ2hpbGQoY2hpbGQpOwordmFyIHNoYWRvdyA9IGhvc3Qud2Via2l0Q3JlYXRlU2hhZG93Um9v dCgpOworY29uZmlndXJlU2hhZG93Um9vdChzaGFkb3cpOworc2hvdWxkQmUoJ2NoaWxkLm9mZnNl dFBhcmVudCcsICdzaGFkb3cucG9zaXRpb25lZEVsZW1lbnQnKTsKKworLy8gVGVzdCB0aGF0IG9m ZnNldFBhcmVudCB3b3JrcyAndGhyb3VnaCcgU2hhZG93IERPTSB3aGVuIHRoZXJlIGlzIG5vCisv LyBwb3NpdGlvbmVkIGFuY2VzdG9yIGluIHVzZXIgYWdlbnQgU2hhZG93IERPTQorc2hhZG93LnBv c2l0aW9uZWRFbGVtZW50LnJlbW92ZUF0dHJpYnV0ZSgnc3R5bGUnKTsKK3Nob3VsZEJlKCdjaGls ZC5vZmZzZXRQYXJlbnQnLCAnY29udGFpbmVyJyk7CisKKy8vIFRlc3QgdGhhdCB3aGVuIHRoZSBv ZmZzZXRQYXJlbnQgaXMgaW4gdXNlciBhZ2VudCBTaGFkb3cgRE9NLCBpdCBpcworLy8gbm90IGV4 cG9zZWQgdG8gc2NyaXB0Citob3N0ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnZGV0YWlscycp OworY29udGFpbmVyLmFwcGVuZENoaWxkKGhvc3QpOworaG9zdC5zZXRBdHRyaWJ1dGUoJ29wZW4n LCAnb3BlbicpOworaG9zdC5hcHBlbmRDaGlsZChjaGlsZCk7Cit2YXIgc2hhZG93ID0gd2luZG93 LmludGVybmFscy55b3VuZ2VzdFNoYWRvd1Jvb3QoaG9zdCk7ICAvLyB0aGlzIGlzIGEgVUEgc2hh ZG93IHJvb3QKK2NvbmZpZ3VyZVNoYWRvd1Jvb3Qoc2hhZG93KTsKK3Nob3VsZEJlKCdjaGlsZC5v ZmZzZXRQYXJlbnQnLCAnbnVsbCcpOworCisvLyBUZXN0IHRoYXQgb2Zmc2V0UGFyZW50IHdvcmtz ICd0aHJvdWdoJyB1c2VyIGFnZW50IFNoYWRvdyBET00gd2hlbiB0aGVyZSBpcyBubworLy8gcG9z aXRpb25lZCBhbmNlc3RvciBpbiB1c2VyIGFnZW50IFNoYWRvdyBET00KK3NoYWRvdy5wb3NpdGlv bmVkRWxlbWVudC5yZW1vdmVBdHRyaWJ1dGUoJ3N0eWxlJyk7CitzaG91bGRCZSgnY2hpbGQub2Zm c2V0UGFyZW50JywgJ2NvbnRhaW5lcicpOworCitjb250YWluZXIucmVtb3ZlKCk7CisKK3N1Y2Nl c3NmdWxseVBhcnNlZCA9IHRydWU7Cis8L3NjcmlwdD4KKzxzY3JpcHQgc3JjPSIuLi8uLi9qcy9y ZXNvdXJjZXMvanMtdGVzdC1wb3N0LmpzIj48L3NjcmlwdD4K