112670 2013-03-19 01:28:47 -0700 FeatureObserver: Measure X-Frame-Options usage. 2013-03-19 14:14:49 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 85558 1 mkwst mkwst abarth japhet webkit.review.bot oldest_to_newest 858036 0 mkwst 2013-03-19 01:28:47 -0700 Given the work in public-webappsec@ around the 'frame-options' CSP directive[1], it would be informative to learn a few things: 1. How often is 'X-Frame-Options' used? 2. How often is 'SAMEORIGIN' used? 3. How often is the top-only implementation of 'SAMEORIGIN' bypassed via an unexpected ancestor chain (e.g. example.com -> evil.com -> example.com)? For #3, see also Mozilla's[2] and public-webappsec@'s[3] discussion on the topic. [1]: http://www.w3.org/TR/UISafety/#frame-options [2]: https://bugzilla.mozilla.org/show_bug.cgi?id=725490 [3]: http://lists.w3.org/Archives/Public/public-webappsec/2013Mar/0007.html 858054 1 193759 mkwst 2013-03-19 01:51:01 -0700 Created attachment 193759 Patch 858062 2 mkwst 2013-03-19 01:57:09 -0700 (In reply to comment #1) > Created an attachment (id=193759) [details] > Patch Hi Adam, as discussed over email, would you mind taking a look at this? The potentially objectionable part is the addition of Frame::isSameOriginWithAllAncestors(). We'll need some sort of mechanism to do this check if/when we implement the 'frame-origin' directive from the UI Safety draft, so adding it now seems reasonable, but I can see good arguments for keeping the patch self-contained inside FrameLoader. Likewise, Frame::* might be a bad place for the method. I'd considered something like 'static bool isFrameSameOriginWithAllAncestors(Frame*)' on SecurityOrigin, but sided with the current implementation for purely asthetic reasons. I'd appreciate your thoughts. 858370 3 193759 abarth 2013-03-19 09:50:29 -0700 Comment on attachment 193759 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=193759&action=review > Source/WebCore/page/Frame.cpp:1051 > +bool Frame::isSameOriginWithAllAncestors() const This function implies that the "same-origin" relation is symmetric, which isn't the case. I'd prefer to line this function into FrameLoader::shouldInterruptLoadForXFrameOptions. It's not really a general-purpose function, and I wouldn't want other code to call it. 858666 4 193907 mkwst 2013-03-19 13:18:11 -0700 Created attachment 193907 Patch for landing 858667 5 mkwst 2013-03-19 13:19:42 -0700 (In reply to comment #3) > (From update of attachment 193759 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=193759&action=review > > > Source/WebCore/page/Frame.cpp:1051 > > +bool Frame::isSameOriginWithAllAncestors() const > > This function implies that the "same-origin" relation is symmetric, which isn't the case. > > I'd prefer to line this function into FrameLoader::shouldInterruptLoadForXFrameOptions. It's not really a general-purpose function, and I wouldn't want other code to call it. Inlined the function, and threw it into the CQ. Thanks for taking a look! 858721 6 193907 webkit.review.bot 2013-03-19 14:14:46 -0700 Comment on attachment 193907 Patch for landing Clearing flags on attachment: 193907 Committed r146257: <http://trac.webkit.org/changeset/146257> 858722 7 webkit.review.bot 2013-03-19 14:14:49 -0700 All reviewed patches have been landed. Closing bug. 193759 2013-03-19 01:51:01 -0700 2013-03-19 13:18:05 -0700 Patch bug-112670-20130319094651.patch text/plain 6591 mkwst U3VidmVyc2lvbiBSZXZpc2lvbjogMTQ2MTg0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMGMyMjA3NDNkMjNlYmVj NmYwMmYwYTE3ZDE1ZDJlNGFhZjc3MDA2YS4uYTc4MTJmNDIyYTRhZmViMDY2Y2MzNjljZTZmZjkw M2Y2MWU4M2JiMSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDUzIEBACisyMDEzLTAzLTE5ICBNaWtl IFdlc3QgIDxta3dzdEBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgRmVhdHVyZU9ic2VydmVyOiBN ZWFzdXJlIFgtRnJhbWUtT3B0aW9ucyB1c2FnZS4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTExMjY3MAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIFRoaXMgcGF0Y2ggYWRkcyB0aHJlZSBGZWF0dXJlT2JzZXJ2 ZXIgZW50cmllcyB0byBnYXRoZXIgaW5mb3JtYXRpb24KKyAgICAgICAgYWJvdXQgJ1gtRnJhbWUt T3B0aW9ucycgdXNhZ2UgaW4gZ2VuZXJhbCwgYW5kIGluIHBhcnRpY3VsYXIgdXNhZ2UKKyAgICAg ICAgYW5kIHBvdGVudGlhbCBtaXN1bmRlcnN0YW5kaW5nIG9mIHRoZSAnU0FNRU9SSUdJTicgdmFs dWUuCisKKyAgICAgICAgVGhyZWUgZW50cmllcyBhcmUgYWRkZWQ6CisKKyAgICAgICAgLSBYRnJh bWVPcHRpb25zIG1lYXN1cmVzIHRoZSByYXcgbnVtYmVyIG9mICdYLUZyYW1lLU9wdGlvbnMnIGhl YWRlcnMuCisKKyAgICAgICAgLSBYRnJhbWVPcHRpb25zU2FtZU9yaWdpbiBtZWFzdXJlcyB0aGUg bnVtYmVyIG9mIHRob3NlIGhlYWRlcnMgdGhhdAorICAgICAgICAgIHNldCB0aGUgdmFsdWUgdG8g J1NBTUVPUklHSU4nLgorCisgICAgICAgIC0gWEZyYW1lT3B0aW9uc1NhbWVPcmlnaW5XaXRoQmFk QW5jZXN0b3JDaGFpbiBtZWFzdXJlcyB0aGUgbnVtYmVyIG9mCisgICAgICAgICAgb2NjYXNpb25z IGluIHdoaWNoIHRoZSBmcmFtZSBwYXNzZWQgdGhlICJ0b3Atb25seSIgb3JpZ2luIGNoZWNrIHdl J3JlCisgICAgICAgICAgY3VycmVudGx5IHBlcmZvcm1pbmcsIGJ1dCB3b3VsZCBoYXZlIGZhaWxl ZCBhIG1vcmUgc3RyaWN0IGNoZWNrCisgICAgICAgICAgYWdhaW5zdCBwb2lzb25lZCBhbmNlc3Rv ciBjaGFpbnMgKHRoYXQgaXMsIGFuIGFuY2VzdG9yIGNoYWluIHRoYXQKKyAgICAgICAgICBsb29r cyBsaWtlICdleGFtcGxlLmNvbScgLT4gJ2V2aWwuY29tJyAtPiAnZXhhbXBsZS5jb20nKS4KKwor ICAgICAgICBNb3ppbGxhIGlzIGNvbnNpZGVyaW5nIGNoYW5naW5nICdTQU1FT1JJR0lOJ3MgYmVo YXZpb3IgdG8gYmxvY2sgdGhlCisgICAgICAgIGxhdHRlciBsb29waG9sZVsxXSwgYW5kIHRoZSBV SSBTYWZldHkgc3BlYyBpcyBjb25zaWRlcmluZyBkcm9wcGluZworICAgICAgICAndG9wLW9ubHkn IGVudGlyZWx5WzJdLiBUaGlzIGRhdGEgd2lsbCBpbmZvcm0gdGhvc2UgZGVjaXNpb25zLgorCisg ICAgICAgIFsxXTogaHR0cHM6Ly9idWd6aWxsYS5tb3ppbGxhLm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 NzI1NDkwCisgICAgICAgIFsyXTogaHR0cDovL2xpc3RzLnczLm9yZy9BcmNoaXZlcy9QdWJsaWMv cHVibGljLXdlYmFwcHNlYy8yMDEzTWFyLzAwMDcuaHRtbAorCisgICAgICAgIFRoaXMgZG9lc24n dCBjaGFuZ2Ugd2ViLXZpc2libGUgYmVoYXZpb3I7IGl0IG9ubHkgYWRkcyBoaXN0b2dyYW1zCisK KyAgICAgICAgKiBsb2FkZXIvRnJhbWVMb2FkZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6RnJh bWVMb2FkZXI6OnNob3VsZEludGVycnVwdExvYWRGb3JYRnJhbWVPcHRpb25zKToKKyAgICAgICAg ICAgIFdoZW4gcHJvY2Vzc2luZyBhbiAnWC1GcmFtZS1PcHRpb25zJyBoZWFkZXIncyB2YWx1ZSwg Y2FsbCBvdXQgdG8KKyAgICAgICAgICAgIEZlYXR1cmVPYnNlcnZlciB3aGVuIHJlbGV2YW50IHRv IGluY3JlbWVudCB0aGUgY29ycmVjdCBoaXN0b2dyYW0KKyAgICAgICAgICAgIGVudHJpZXMuCisg ICAgICAgICogcGFnZS9GZWF0dXJlT2JzZXJ2ZXIuaDoKKyAgICAgICAgICAgIEFkZGVkIHRocmVl IGVudHJpZXMgdG8gdGhlIEZlYXR1cmVPYnNlcnZlciBlbnVtOiBYRnJhbWVPcHRpb25zLAorICAg ICAgICAgICAgWEZyYW1lT3B0aW9uc1NhbWVPcmlnaW4sIGFuZCBYRnJhbWVPcHRpb25zU2FtZU9y aWdpbldpdGhCYWRBbmNlc3RvckNoYWluLgorICAgICAgICAgICAgRWFjaCBpcyBleHBsYWluZWQg YWJvdmUuCisgICAgICAgICogcGFnZS9GcmFtZS5oOgorICAgICAgICAqIHBhZ2UvRnJhbWUuY3Bw OgorICAgICAgICAoV2ViQ29yZTo6RnJhbWU6OmlzU2FtZU9yaWdpbldpdGhBbGxBbmNlc3RvcnMp OgorICAgICAgICAgICAgQSBjb252aW5pZW5jZSBtZXRob2QgdG8gZGV0ZXJtaW5lIHdoZXRoZXIg YSBGcmFtZSBpcyBzYW1lLW9yaWdpbgorICAgICAgICAgICAgd2l0aCBlYWNoIG9mIGl0cyBhbmNl c3RvcnMuIEkgY29uc2lkZXJlZCBhZGRpbmcgdGhpcyBhcyBhIHN0YXRpYworICAgICAgICAgICAg bWV0aG9kIHRvIFNlY3VyaXR5T3JpZ2luLCBidXQgaXQgc2VlbWVkIHRvIGZpdCBiZXR0ZXIgb24g RnJhbWUKKyAgICAgICAgICAgIGl0c2VsZi4KKwogMjAxMy0wMy0xOSAgQWxleGFuZGVyIFBhdmxv diAgPGFwYXZsb3ZAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFdlYiBJbnNwZWN0b3I6IFtTdHls ZXNdIE1hdGNoaW5nIEBob3N0IHJ1bGUgY2hpbGRyZW4gYXJlIG5vdCBkaXNwbGF5ZWQKZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9GcmFtZUxvYWRlci5jcHAgYi9Tb3VyY2UvV2Vi Q29yZS9sb2FkZXIvRnJhbWVMb2FkZXIuY3BwCmluZGV4IDg5Y2JiNWIwOGEyNTNmOTNkNTZiY2Jm OTkzMGM2MGU5ZDE5YTIyMjguLjNhYjQxNzUyYjI0MzJlNWJiZmVmYjAwYmYwZmI3M2IyZTAyODI5 ZDQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9GcmFtZUxvYWRlci5jcHAKKysr IGIvU291cmNlL1dlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcApAQCAtMjk1MCw2ICsyOTUw LDggQEAgdm9pZCBGcmFtZUxvYWRlcjo6YXBwbHlVc2VyQWdlbnQoUmVzb3VyY2VSZXF1ZXN0JiBy ZXF1ZXN0KQogCiBib29sIEZyYW1lTG9hZGVyOjpzaG91bGRJbnRlcnJ1cHRMb2FkRm9yWEZyYW1l T3B0aW9ucyhjb25zdCBTdHJpbmcmIGNvbnRlbnQsIGNvbnN0IEtVUkwmIHVybCwgdW5zaWduZWQg bG9uZyByZXF1ZXN0SWRlbnRpZmllcikKIHsKKyAgICBGZWF0dXJlT2JzZXJ2ZXI6Om9ic2VydmUo bV9mcmFtZS0+ZG9jdW1lbnQoKSwgRmVhdHVyZU9ic2VydmVyOjpYRnJhbWVPcHRpb25zKTsKKwog ICAgIEZyYW1lKiB0b3BGcmFtZSA9IG1fZnJhbWUtPnRyZWUoKS0+dG9wKCk7CiAgICAgaWYgKG1f ZnJhbWUgPT0gdG9wRnJhbWUpCiAgICAgICAgIHJldHVybiBmYWxzZTsKQEAgLTI5NTcsOSArMjk1 OSwxMiBAQCBib29sIEZyYW1lTG9hZGVyOjpzaG91bGRJbnRlcnJ1cHRMb2FkRm9yWEZyYW1lT3B0 aW9ucyhjb25zdCBTdHJpbmcmIGNvbnRlbnQsIGNvbgogICAgIGlmIChlcXVhbElnbm9yaW5nQ2Fz ZShjb250ZW50LCAiZGVueSIpKQogICAgICAgICByZXR1cm4gdHJ1ZTsKICAgICBlbHNlIGlmIChl cXVhbElnbm9yaW5nQ2FzZShjb250ZW50LCAic2FtZW9yaWdpbiIpKSB7CisgICAgICAgIEZlYXR1 cmVPYnNlcnZlcjo6b2JzZXJ2ZShtX2ZyYW1lLT5kb2N1bWVudCgpLCBGZWF0dXJlT2JzZXJ2ZXI6 OlhGcmFtZU9wdGlvbnNTYW1lT3JpZ2luKTsKICAgICAgICAgUmVmUHRyPFNlY3VyaXR5T3JpZ2lu PiBvcmlnaW4gPSBTZWN1cml0eU9yaWdpbjo6Y3JlYXRlKHVybCk7CiAgICAgICAgIGlmICghb3Jp Z2luLT5pc1NhbWVTY2hlbWVIb3N0UG9ydCh0b3BGcmFtZS0+ZG9jdW1lbnQoKS0+c2VjdXJpdHlP cmlnaW4oKSkpCiAgICAgICAgICAgICByZXR1cm4gdHJ1ZTsKKyAgICAgICAgaWYgKCFtX2ZyYW1l LT5pc1NhbWVPcmlnaW5XaXRoQWxsQW5jZXN0b3JzKCkpCisgICAgICAgICAgICBGZWF0dXJlT2Jz ZXJ2ZXI6Om9ic2VydmUobV9mcmFtZS0+ZG9jdW1lbnQoKSwgRmVhdHVyZU9ic2VydmVyOjpYRnJh bWVPcHRpb25zU2FtZU9yaWdpbldpdGhCYWRBbmNlc3RvckNoYWluKTsKICAgICB9IGVsc2UgaWYg KCFlcXVhbElnbm9yaW5nQ2FzZShjb250ZW50LCAiYWxsb3dhbGwiKSkgewogICAgICAgICBTdHJp bmcgbWVzc2FnZSA9ICJJbnZhbGlkICdYLUZyYW1lLU9wdGlvbnMnIGhlYWRlciBlbmNvdW50ZXJl ZCB3aGVuIGxvYWRpbmcgJyIgKyB1cmwuZWxpZGVkU3RyaW5nKCkgKyAiJzogJyIgKyBjb250ZW50 ICsgIicgaXMgbm90IGEgcmVjb2duaXplZCBkaXJlY3RpdmUuIFRoZSBoZWFkZXIgd2lsbCBiZSBp Z25vcmVkLiI7CiAgICAgICAgIG1fZnJhbWUtPmRvY3VtZW50KCktPmFkZENvbnNvbGVNZXNzYWdl KEpTTWVzc2FnZVNvdXJjZSwgRXJyb3JNZXNzYWdlTGV2ZWwsIG1lc3NhZ2UsIHJlcXVlc3RJZGVu dGlmaWVyKTsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvRmVhdHVyZU9ic2VydmVy LmggYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZlYXR1cmVPYnNlcnZlci5oCmluZGV4IDYzNTBhNWJi M2E4ODc1OWYwOGUxNjBmZmJjODdjMjM2YmJiMTMxMjkuLjAzM2Y5NjRjMTg1MzBiODNkODExNmU4 NmU5YzA3Yzc0MmQzYjllYzUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvRmVhdHVy ZU9ic2VydmVyLmgKKysrIGIvU291cmNlL1dlYkNvcmUvcGFnZS9GZWF0dXJlT2JzZXJ2ZXIuaApA QCAtMTAxLDYgKzEwMSw5IEBAIHB1YmxpYzoKICAgICAgICAgUmVmbGVjdGlvbiwKICAgICAgICAg Q3Vyc29yVmlzaWJpbGl0eSwKICAgICAgICAgU3RvcmFnZUluZm8sCisgICAgICAgIFhGcmFtZU9w dGlvbnMsCisgICAgICAgIFhGcmFtZU9wdGlvbnNTYW1lT3JpZ2luLAorICAgICAgICBYRnJhbWVP cHRpb25zU2FtZU9yaWdpbldpdGhCYWRBbmNlc3RvckNoYWluLAogICAgICAgICAvLyBBZGQgbmV3 IGZlYXR1cmVzIGFib3ZlIHRoaXMgbGluZS4gRG9uJ3QgY2hhbmdlIGFzc2lnbmVkIG51bWJlcnMg b2YgZWFjaCBpdGVtcy4KICAgICAgICAgTnVtYmVyT2ZGZWF0dXJlcywgLy8gVGhpcyBlbnVtIHZh bHVlIG11c3QgYmUgbGFzdC4KICAgICB9OwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGFn ZS9GcmFtZS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcAppbmRleCA4ODU5ZGMw NTFhYzdjMjM3ZThjNGZhZTBmOGQzNzU1NzcxYjk0ZDZkLi4xYjI2Njg2MTU0Y2U2N2M3NjA2MGI4 MWUzYjkyODAzNTFkNDEyM2Y0IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1l LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcApAQCAtNzksNiArNzksNyBA QAogI2luY2x1ZGUgIlNjcmlwdFNvdXJjZUNvZGUuaCIKICNpbmNsdWRlICJTY3JpcHRWYWx1ZS5o IgogI2luY2x1ZGUgIlNjcm9sbGluZ0Nvb3JkaW5hdG9yLmgiCisjaW5jbHVkZSAiU2VjdXJpdHlP cmlnaW4uaCIKICNpbmNsdWRlICJTZXR0aW5ncy5oIgogI2luY2x1ZGUgIlN0eWxlUHJvcGVydHlT ZXQuaCIKICNpbmNsdWRlICJUZXh0SXRlcmF0b3IuaCIKQEAgLTEwNDcsNiArMTA0OCwxNiBAQCBi b29sIEZyYW1lOjppc1VSTEFsbG93ZWQoY29uc3QgS1VSTCYgdXJsKSBjb25zdAogICAgIHJldHVy biB0cnVlOwogfQogCitib29sIEZyYW1lOjppc1NhbWVPcmlnaW5XaXRoQWxsQW5jZXN0b3JzKCkg Y29uc3QKK3sKKyAgICBTZWN1cml0eU9yaWdpbiogb3JpZ2luID0gZG9jdW1lbnQoKS0+c2VjdXJp dHlPcmlnaW4oKTsKKyAgICBmb3IgKEZyYW1lKiBmcmFtZSA9IHRyZWUoKS0+cGFyZW50KCk7IGZy YW1lOyBmcmFtZSA9IGZyYW1lLT50cmVlKCktPnBhcmVudCgpKSB7CisgICAgICAgIGlmICghb3Jp Z2luLT5pc1NhbWVTY2hlbWVIb3N0UG9ydChmcmFtZS0+ZG9jdW1lbnQoKS0+c2VjdXJpdHlPcmln aW4oKSkpCisgICAgICAgICAgICByZXR1cm4gZmFsc2U7CisgICAgfQorICAgIHJldHVybiB0cnVl OworfQorCiAjaWYgIVBMQVRGT1JNKE1BQykgJiYgIVBMQVRGT1JNKFdJTikKIHN0cnVjdCBTY29w ZWRGcmFtZVBhaW50aW5nU3RhdGUgewogICAgIFNjb3BlZEZyYW1lUGFpbnRpbmdTdGF0ZShGcmFt ZSogZnJhbWUsIE5vZGUqIG5vZGUpCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL0Zy YW1lLmggYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1lLmgKaW5kZXggM2Q5MDliNTk1YmM5NDk1 NDk3MjRkY2YxZTBlMDU5MTVhZmY1NDlkYi4uMjA5YTBiNDg4MGRkNTA0ZTNlYWM5MjEzZjE1ZWU1 NTlkNjU4MDZiNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGFnZS9GcmFtZS5oCisrKyBi L1NvdXJjZS9XZWJDb3JlL3BhZ2UvRnJhbWUuaApAQCAtMjA1LDYgKzIwNSw4IEBAIG5hbWVzcGFj ZSBXZWJDb3JlIHsKIAogICAgICAgICBib29sIGlzVVJMQWxsb3dlZChjb25zdCBLVVJMJikgY29u c3Q7CiAKKyAgICAgICAgYm9vbCBpc1NhbWVPcmlnaW5XaXRoQWxsQW5jZXN0b3JzKCkgY29uc3Q7 CisKICAgICAvLyA9PT09PT09PQogCiAgICAgcHJpdmF0ZToK 193907 2013-03-19 13:18:11 -0700 2013-03-19 14:14:46 -0700 Patch for landing bug-112670-20130319211400.patch text/plain 4949 mkwst U3VidmVyc2lvbiBSZXZpc2lvbjogMTQ2MjMwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggN2NhYThjZDk1MmQ2NDc4 NDI1M2NlMGZjNTg3Nzc2YTIwOGViZDI0Yi4uYmEwNGU4MTE5YmQ3ZWQ0MzgzOTFhZGM1MzhlODhm NzAwMmFjYTYwNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDQ2IEBACisyMDEzLTAzLTE5ICBNaWtl IFdlc3QgIDxta3dzdEBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgRmVhdHVyZU9ic2VydmVyOiBN ZWFzdXJlIFgtRnJhbWUtT3B0aW9ucyB1c2FnZS4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTExMjY3MAorCisgICAgICAgIFJldmlld2VkIGJ5IEFkYW0g QmFydGguCisKKyAgICAgICAgVGhpcyBwYXRjaCBhZGRzIHRocmVlIEZlYXR1cmVPYnNlcnZlciBl bnRyaWVzIHRvIGdhdGhlciBpbmZvcm1hdGlvbgorICAgICAgICBhYm91dCAnWC1GcmFtZS1PcHRp b25zJyB1c2FnZSBpbiBnZW5lcmFsLCBhbmQgaW4gcGFydGljdWxhciB1c2FnZQorICAgICAgICBh bmQgcG90ZW50aWFsIG1pc3VuZGVyc3RhbmRpbmcgb2YgdGhlICdTQU1FT1JJR0lOJyB2YWx1ZS4K KworICAgICAgICBUaHJlZSBlbnRyaWVzIGFyZSBhZGRlZDoKKworICAgICAgICAtIFhGcmFtZU9w dGlvbnMgbWVhc3VyZXMgdGhlIHJhdyBudW1iZXIgb2YgJ1gtRnJhbWUtT3B0aW9ucycgaGVhZGVy cy4KKworICAgICAgICAtIFhGcmFtZU9wdGlvbnNTYW1lT3JpZ2luIG1lYXN1cmVzIHRoZSBudW1i ZXIgb2YgdGhvc2UgaGVhZGVycyB0aGF0CisgICAgICAgICAgc2V0IHRoZSB2YWx1ZSB0byAnU0FN RU9SSUdJTicuCisKKyAgICAgICAgLSBYRnJhbWVPcHRpb25zU2FtZU9yaWdpbldpdGhCYWRBbmNl c3RvckNoYWluIG1lYXN1cmVzIHRoZSBudW1iZXIgb2YKKyAgICAgICAgICBvY2Nhc2lvbnMgaW4g d2hpY2ggdGhlIGZyYW1lIHBhc3NlZCB0aGUgInRvcC1vbmx5IiBvcmlnaW4gY2hlY2sgd2UncmUK KyAgICAgICAgICBjdXJyZW50bHkgcGVyZm9ybWluZywgYnV0IHdvdWxkIGhhdmUgZmFpbGVkIGEg bW9yZSBzdHJpY3QgY2hlY2sKKyAgICAgICAgICBhZ2FpbnN0IHBvaXNvbmVkIGFuY2VzdG9yIGNo YWlucyAodGhhdCBpcywgYW4gYW5jZXN0b3IgY2hhaW4gdGhhdAorICAgICAgICAgIGxvb2tzIGxp a2UgJ2V4YW1wbGUuY29tJyAtPiAnZXZpbC5jb20nIC0+ICdleGFtcGxlLmNvbScpLgorCisgICAg ICAgIE1vemlsbGEgaXMgY29uc2lkZXJpbmcgY2hhbmdpbmcgJ1NBTUVPUklHSU4ncyBiZWhhdmlv ciB0byBibG9jayB0aGUKKyAgICAgICAgbGF0dGVyIGxvb3Bob2xlWzFdLCBhbmQgdGhlIFVJIFNh ZmV0eSBzcGVjIGlzIGNvbnNpZGVyaW5nIGRyb3BwaW5nCisgICAgICAgICd0b3Atb25seScgZW50 aXJlbHlbMl0uIFRoaXMgZGF0YSB3aWxsIGluZm9ybSB0aG9zZSBkZWNpc2lvbnMuCisKKyAgICAg ICAgWzFdOiBodHRwczovL2J1Z3ppbGxhLm1vemlsbGEub3JnL3Nob3dfYnVnLmNnaT9pZD03MjU0 OTAKKyAgICAgICAgWzJdOiBodHRwOi8vbGlzdHMudzMub3JnL0FyY2hpdmVzL1B1YmxpYy9wdWJs aWMtd2ViYXBwc2VjLzIwMTNNYXIvMDAwNy5odG1sCisKKyAgICAgICAgVGhpcyBkb2Vzbid0IGNo YW5nZSB3ZWItdmlzaWJsZSBiZWhhdmlvcjsgaXQgb25seSBhZGRzIGhpc3RvZ3JhbXMKKworICAg ICAgICAqIGxvYWRlci9GcmFtZUxvYWRlci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpGcmFtZUxv YWRlcjo6c2hvdWxkSW50ZXJydXB0TG9hZEZvclhGcmFtZU9wdGlvbnMpOgorICAgICAgICAgICAg V2hlbiBwcm9jZXNzaW5nIGFuICdYLUZyYW1lLU9wdGlvbnMnIGhlYWRlcidzIHZhbHVlLCBjYWxs IG91dCB0bworICAgICAgICAgICAgRmVhdHVyZU9ic2VydmVyIHdoZW4gcmVsZXZhbnQgdG8gaW5j cmVtZW50IHRoZSBjb3JyZWN0IGhpc3RvZ3JhbQorICAgICAgICAgICAgZW50cmllcy4KKyAgICAg ICAgKiBwYWdlL0ZlYXR1cmVPYnNlcnZlci5oOgorICAgICAgICAgICAgQWRkZWQgdGhyZWUgZW50 cmllcyB0byB0aGUgRmVhdHVyZU9ic2VydmVyIGVudW06IFhGcmFtZU9wdGlvbnMsCisgICAgICAg ICAgICBYRnJhbWVPcHRpb25zU2FtZU9yaWdpbiwgYW5kIFhGcmFtZU9wdGlvbnNTYW1lT3JpZ2lu V2l0aEJhZEFuY2VzdG9yQ2hhaW4uCisgICAgICAgICAgICBFYWNoIGlzIGV4cGxhaW5lZCBhYm92 ZS4KKwogMjAxMy0wMy0xOSAgTGVvbiBTY3JvZ2dpbnMgIDxzY3JvZ2dvQGNocm9taXVtLm9yZz4K IAogICAgICAgICBJbXBsZW1lbnQgb25SZWZFbmNvZGVkRGF0YSBmb3IgbGF6eSBwaXhlbCByZWZz LgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcCBiL1Nv dXJjZS9XZWJDb3JlL2xvYWRlci9GcmFtZUxvYWRlci5jcHAKaW5kZXggODljYmI1YjA4YTI1M2Y5 M2Q1NmJjYmY5OTMwYzYwZTlkMTlhMjIyOC4uMDZkOTNmZmVhZjQ0ZWMwYjI1MzNjOTZlZGM4NTM4 ZTNmZTc0ZjcxNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVy LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvRnJhbWVMb2FkZXIuY3BwCkBAIC0yOTUw LDYgKzI5NTAsOCBAQCB2b2lkIEZyYW1lTG9hZGVyOjphcHBseVVzZXJBZ2VudChSZXNvdXJjZVJl cXVlc3QmIHJlcXVlc3QpCiAKIGJvb2wgRnJhbWVMb2FkZXI6OnNob3VsZEludGVycnVwdExvYWRG b3JYRnJhbWVPcHRpb25zKGNvbnN0IFN0cmluZyYgY29udGVudCwgY29uc3QgS1VSTCYgdXJsLCB1 bnNpZ25lZCBsb25nIHJlcXVlc3RJZGVudGlmaWVyKQogeworICAgIEZlYXR1cmVPYnNlcnZlcjo6 b2JzZXJ2ZShtX2ZyYW1lLT5kb2N1bWVudCgpLCBGZWF0dXJlT2JzZXJ2ZXI6OlhGcmFtZU9wdGlv bnMpOworCiAgICAgRnJhbWUqIHRvcEZyYW1lID0gbV9mcmFtZS0+dHJlZSgpLT50b3AoKTsKICAg ICBpZiAobV9mcmFtZSA9PSB0b3BGcmFtZSkKICAgICAgICAgcmV0dXJuIGZhbHNlOwpAQCAtMjk1 Nyw5ICsyOTU5LDE2IEBAIGJvb2wgRnJhbWVMb2FkZXI6OnNob3VsZEludGVycnVwdExvYWRGb3JY RnJhbWVPcHRpb25zKGNvbnN0IFN0cmluZyYgY29udGVudCwgY29uCiAgICAgaWYgKGVxdWFsSWdu b3JpbmdDYXNlKGNvbnRlbnQsICJkZW55IikpCiAgICAgICAgIHJldHVybiB0cnVlOwogICAgIGVs c2UgaWYgKGVxdWFsSWdub3JpbmdDYXNlKGNvbnRlbnQsICJzYW1lb3JpZ2luIikpIHsKKyAgICAg ICAgRmVhdHVyZU9ic2VydmVyOjpvYnNlcnZlKG1fZnJhbWUtPmRvY3VtZW50KCksIEZlYXR1cmVP YnNlcnZlcjo6WEZyYW1lT3B0aW9uc1NhbWVPcmlnaW4pOwogICAgICAgICBSZWZQdHI8U2VjdXJp dHlPcmlnaW4+IG9yaWdpbiA9IFNlY3VyaXR5T3JpZ2luOjpjcmVhdGUodXJsKTsKICAgICAgICAg aWYgKCFvcmlnaW4tPmlzU2FtZVNjaGVtZUhvc3RQb3J0KHRvcEZyYW1lLT5kb2N1bWVudCgpLT5z ZWN1cml0eU9yaWdpbigpKSkKICAgICAgICAgICAgIHJldHVybiB0cnVlOworICAgICAgICBmb3Ig KEZyYW1lKiBmcmFtZSA9IG1fZnJhbWUtPnRyZWUoKS0+cGFyZW50KCk7IGZyYW1lOyBmcmFtZSA9 IGZyYW1lLT50cmVlKCktPnBhcmVudCgpKSB7CisgICAgICAgICAgICBpZiAoIW9yaWdpbi0+aXNT YW1lU2NoZW1lSG9zdFBvcnQoZnJhbWUtPmRvY3VtZW50KCktPnNlY3VyaXR5T3JpZ2luKCkpKSB7 CisgICAgICAgICAgICAgICAgRmVhdHVyZU9ic2VydmVyOjpvYnNlcnZlKG1fZnJhbWUtPmRvY3Vt ZW50KCksIEZlYXR1cmVPYnNlcnZlcjo6WEZyYW1lT3B0aW9uc1NhbWVPcmlnaW5XaXRoQmFkQW5j ZXN0b3JDaGFpbik7CisgICAgICAgICAgICAgICAgYnJlYWs7CisgICAgICAgICAgICB9CisgICAg ICAgIH0KICAgICB9IGVsc2UgaWYgKCFlcXVhbElnbm9yaW5nQ2FzZShjb250ZW50LCAiYWxsb3dh bGwiKSkgewogICAgICAgICBTdHJpbmcgbWVzc2FnZSA9ICJJbnZhbGlkICdYLUZyYW1lLU9wdGlv bnMnIGhlYWRlciBlbmNvdW50ZXJlZCB3aGVuIGxvYWRpbmcgJyIgKyB1cmwuZWxpZGVkU3RyaW5n KCkgKyAiJzogJyIgKyBjb250ZW50ICsgIicgaXMgbm90IGEgcmVjb2duaXplZCBkaXJlY3RpdmUu IFRoZSBoZWFkZXIgd2lsbCBiZSBpZ25vcmVkLiI7CiAgICAgICAgIG1fZnJhbWUtPmRvY3VtZW50 KCktPmFkZENvbnNvbGVNZXNzYWdlKEpTTWVzc2FnZVNvdXJjZSwgRXJyb3JNZXNzYWdlTGV2ZWws IG1lc3NhZ2UsIHJlcXVlc3RJZGVudGlmaWVyKTsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3Jl L3BhZ2UvRmVhdHVyZU9ic2VydmVyLmggYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZlYXR1cmVPYnNl cnZlci5oCmluZGV4IDYzNTBhNWJiM2E4ODc1OWYwOGUxNjBmZmJjODdjMjM2YmJiMTMxMjkuLjAz M2Y5NjRjMTg1MzBiODNkODExNmU4NmU5YzA3Yzc0MmQzYjllYzUgMTAwNjQ0Ci0tLSBhL1NvdXJj ZS9XZWJDb3JlL3BhZ2UvRmVhdHVyZU9ic2VydmVyLmgKKysrIGIvU291cmNlL1dlYkNvcmUvcGFn ZS9GZWF0dXJlT2JzZXJ2ZXIuaApAQCAtMTAxLDYgKzEwMSw5IEBAIHB1YmxpYzoKICAgICAgICAg UmVmbGVjdGlvbiwKICAgICAgICAgQ3Vyc29yVmlzaWJpbGl0eSwKICAgICAgICAgU3RvcmFnZUlu Zm8sCisgICAgICAgIFhGcmFtZU9wdGlvbnMsCisgICAgICAgIFhGcmFtZU9wdGlvbnNTYW1lT3Jp Z2luLAorICAgICAgICBYRnJhbWVPcHRpb25zU2FtZU9yaWdpbldpdGhCYWRBbmNlc3RvckNoYWlu LAogICAgICAgICAvLyBBZGQgbmV3IGZlYXR1cmVzIGFib3ZlIHRoaXMgbGluZS4gRG9uJ3QgY2hh bmdlIGFzc2lnbmVkIG51bWJlcnMgb2YgZWFjaCBpdGVtcy4KICAgICAgICAgTnVtYmVyT2ZGZWF0 dXJlcywgLy8gVGhpcyBlbnVtIHZhbHVlIG11c3QgYmUgbGFzdC4KICAgICB9Owo=