115321 2013-04-27 22:33:57 -0700 Implement file path restrictions in WebKit Objective C API 2013-04-30 22:15:34 -0700 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ap ap andersca sam oldest_to_newest 882360 0 ap 2013-04-27 22:33:57 -0700 Currently, allowedDirectory argument is just ignored. <rdar://problem/13574729> 882361 1 199959 ap 2013-04-27 22:39:38 -0700 Created attachment 199959 proposed patch 882362 2 199959 darin 2013-04-27 23:14:57 -0700 Comment on attachment 199959 proposed patch View in context: https://bugs.webkit.org/attachment.cgi?id=199959&action=review > Source/WebCore/platform/KURL.cpp:340 > +KURL KURL::fromFileSystemPath(const String& path) > +{ > + return KURL(ParsedURLString, "file://" + path); > +} This doesn’t seem right unless the path has special characters such as "#" already URL-encoded. Given the function name, I don’t see how that is clear. 882363 3 199959 darin 2013-04-27 23:15:30 -0700 Comment on attachment 199959 proposed patch View in context: https://bugs.webkit.org/attachment.cgi?id=199959&action=review > Source/WebCore/platform/KURL.h:53 > +enum FileSystemPathTag { FileSystemPath }; Looks like this is unused; presumably used in an earlier version of the patch. 882364 4 199959 darin 2013-04-27 23:18:11 -0700 Comment on attachment 199959 proposed patch View in context: https://bugs.webkit.org/attachment.cgi?id=199959&action=review >> Source/WebCore/platform/KURL.cpp:340 >> +} > > This doesn’t seem right unless the path has special characters such as "#" already URL-encoded. Given the function name, I don’t see how that is clear. I think a correct version needs to call encodeWithURLEscapeSequences. And I think we need a fast path in encodeWithURLEscapeSequences for when nothing needs encoding. And I think that KURL::setPath has an incorrect FIXME in it. 882390 5 ap 2013-04-28 09:07:51 -0700 I'd like to hear what Sam or Anders think about the proposed C API before updating the patch. Perhaps it should take a WKURLRef, not a WKStringRef? 882396 6 sam 2013-04-28 10:41:56 -0700 (In reply to comment #5) > I'd like to hear what Sam or Anders think about the proposed C API before updating the patch. Perhaps it should take a WKURLRef, not a WKStringRef? A URL makes more sense to me. 882473 7 199984 ap 2013-04-28 23:05:45 -0700 Created attachment 199984 proposed patch > A URL makes more sense to me. OK 882608 8 199984 darin 2013-04-29 08:40:06 -0700 Comment on attachment 199984 proposed patch View in context: https://bugs.webkit.org/attachment.cgi?id=199984&action=review > Source/WebKit2/UIProcess/WebPageProxy.cpp:751 > + resourceDirectoryURL = KURL(ParsedURLString, "file:///"); > + > + String resourceDirectoryPath = resourceDirectoryURL.fileSystemPath(); Seems a little strange to construct a URL with "file:///" in it just to extract the "/" out of it afterward. Could define resourceDirectoryPath earlier and set it to "/" when resourceDirectoryURLString in a more direct way. I think it’s also good to use ASCIILiteral in cases like this. > Source/WebKit2/UIProcess/WebPageProxy.h:291 > + void loadFile(const String& fileURL, const String& resourceDirectoryURL); Strange for this to take URL strings instead of URLs. > Source/WebKit2/UIProcess/API/C/WKPage.cpp:97 > + toImpl(pageRef)->loadFile(toWTFString(fileURL), toWTFString(resourceDirectoryURL)); Why not convert WKURLRef to KURL instead of going through String? > Source/WebKit2/UIProcess/API/C/WKPage.h:365 > +WK_EXPORT void WKPageLoadFile(WKPageRef page, WKURLRef fileURL, WKURLRef resourceDirectoryURL); I agree that these argument types make sense given Cocoa’s use of CFURL and NSURL for file paths. > Source/WebKit2/UIProcess/API/mac/WKBrowsingContextController.mm:128 > WKRetainPtr<WKURLRef> wkURL = adoptWK(WKURLCreateWithCFURL((CFURLRef)URL)); > - WKPageLoadURL(self._pageRef, wkURL.get()); > + WKRetainPtr<WKURLRef> wkAllowedDirectory = adoptWK(WKURLCreateWithCFURL((CFURLRef)allowedDirectory)); > + > + WKPageLoadFile(self._pageRef, wkURL.get(), wkAllowedDirectory.get()); It seems a little unwieldy to have these local variables. WIth a helper function to convert NSURL to WKRetainPtr<WKURLRef> we could make this a lot simpler. 883384 9 ap 2013-04-30 22:15:34 -0700 Committed <http://trac.webkit.org/r149422>. > Strange for this to take URL strings instead of URLs. I was following the pattern of loadURL(const String&) here. 199959 2013-04-27 22:39:38 -0700 2013-04-28 23:05:45 -0700 proposed patch RestrictToDirectory.txt text/plain 7825 ap SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE0OTI1NikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDEzLTA0LTI3ICBBbGV4ZXkg UHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29tPgorCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8x MzU3NDcyOT4gSW1wbGVtZW50IGZpbGUgcGF0aCByZXN0cmljdGlvbnMgaW4gV2ViS2l0IE9iamVj dGl2ZSBDIEFQSQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9MTE1MzIxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgQWRkZWQgYSBmdW5jdGlvbiB0aGF0IGNyZWF0ZXMgYSBLVVJMIGZyb20gYSBmaWxlIHN5c3Rl bSBwYXRoLgorCisgICAgICAgICogV2ViQ29yZS5leHAuaW46CisgICAgICAgICogcGxhdGZvcm0v S1VSTC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpLVVJMOjpmcm9tRmlsZVN5c3RlbVBhdGgpOgor ICAgICAgICAqIHBsYXRmb3JtL0tVUkwuaDoKKwogMjAxMy0wNC0yNyAgRGFyaW4gQWRsZXIgIDxk YXJpbkBhcHBsZS5jb20+CiAKICAgICAgICAgTW92ZSBmcm9tIGNvbnN0cnVjdG9yIGFuZCBtZW1i ZXIgZnVuY3Rpb24gYWRvcHRDRi9OUyB0byBmcmVlIGZ1bmN0aW9uIGFkb3B0Q0YvTlMuCkluZGV4 OiBTb3VyY2UvV2ViQ29yZS9XZWJDb3JlLmV4cC5pbgo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9XZWJDb3JlLmV4cC5pbgkocmV2aXNpb24gMTQ5MjUyKQorKysgU291cmNlL1dlYkNvcmUv V2ViQ29yZS5leHAuaW4JKHdvcmtpbmcgY29weSkKQEAgLTgwMCw2ICs4MDAsNyBAQCBfX1pON1dl YkNvcmU0Rm9udGFTRVJLUzBfCiBfX1pON1dlYkNvcmU0SWNvbjE4Y3JlYXRlSWNvbkZvckZpbGVz RVJLTjNXVEY2VmVjdG9ySU5TMV82U3RyaW5nRUxtMEVOUzFfMTVDcmFzaE9uT3ZlcmZsb3dFRUUK IF9fWk43V2ViQ29yZTRJY29uRDFFdgogX19aTjdXZWJDb3JlNEtVUkwxMGludmFsaWRhdGVFdgor X19aTjdXZWJDb3JlNEtVUkwxOGZyb21GaWxlU3lzdGVtUGF0aEVSS04zV1RGNlN0cmluZ0UKIF9f Wk43V2ViQ29yZTRLVVJMQzFFTlNfMThQYXJzZWRVUkxTdHJpbmdUYWdFUktOM1dURjZTdHJpbmdF CiBfX1pON1dlYkNvcmU0S1VSTEMxRVA1TlNVUkwKIF9fWk43V2ViQ29yZTRLVVJMQzFFUEs3X19D RlVSTApJbmRleDogU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vS1VSTC5jcHAKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vS1VSTC5jcHAJKHJldmlzaW9uIDE0OTI1MikKKysr IFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL0tVUkwuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0zMzQs NiArMzM0LDExIEBAIEtVUkw6OktVUkwoUGFyc2VkVVJMU3RyaW5nVGFnLCBjb25zdCBTdHIKICAg ICBBU1NFUlQodXJsID09IG1fc3RyaW5nKTsKIH0KIAorS1VSTCBLVVJMOjpmcm9tRmlsZVN5c3Rl bVBhdGgoY29uc3QgU3RyaW5nJiBwYXRoKQoreworICAgIHJldHVybiBLVVJMKFBhcnNlZFVSTFN0 cmluZywgImZpbGU6Ly8iICsgcGF0aCk7Cit9CisKIEtVUkw6OktVUkwoY29uc3QgS1VSTCYgYmFz ZSwgY29uc3QgU3RyaW5nJiByZWxhdGl2ZSkKIHsKICAgICBpbml0KGJhc2UsIHJlbGF0aXZlLCBV VEY4RW5jb2RpbmcoKSk7CkluZGV4OiBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9LVVJMLmgKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vS1VSTC5oCShyZXZpc2lvbiAxNDky NTIpCisrKyBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9LVVJMLmgJKHdvcmtpbmcgY29weSkKQEAg LTUwLDYgKzUwLDcgQEAgY2xhc3MgVGV4dEVuY29kaW5nOwogc3RydWN0IEtVUkxIYXNoOwogCiBl bnVtIFBhcnNlZFVSTFN0cmluZ1RhZyB7IFBhcnNlZFVSTFN0cmluZyB9OworZW51bSBGaWxlU3lz dGVtUGF0aFRhZyB7IEZpbGVTeXN0ZW1QYXRoIH07CiAKIGNsYXNzIEtVUkwgewogcHVibGljOgpA QCAtNjAsNiArNjEsOSBAQCBwdWJsaWM6CiAgICAgLy8gS1VSTCBvYmplY3QsIG9yIGluZGlzY2Vy bmlibGUgZnJvbSBzdWNoLgogICAgIC8vIEl0IGlzIHVzdWFsbHkgYmVzdCB0byBhdm9pZCByZXBl YXRlZGx5IHBhcnNpbmcgYSBzdHJpbmcsIHVubGVzcyBtZW1vcnkgc2F2aW5nIG91dHdlaWdoIHRo ZSBwb3NzaWJsZSBzbG93LWRvd25zLgogICAgIEtVUkwoUGFyc2VkVVJMU3RyaW5nVGFnLCBjb25z dCBTdHJpbmcmKTsKKworICAgIHN0YXRpYyBLVVJMIGZyb21GaWxlU3lzdGVtUGF0aChjb25zdCBT dHJpbmcmKTsKKwogICAgIGV4cGxpY2l0IEtVUkwoV1RGOjpIYXNoVGFibGVEZWxldGVkVmFsdWVU eXBlKSA6IG1fc3RyaW5nKFdURjo6SGFzaFRhYmxlRGVsZXRlZFZhbHVlKSB7IH0KICAgICBib29s IGlzSGFzaFRhYmxlRGVsZXRlZFZhbHVlKCkgY29uc3QgeyByZXR1cm4gc3RyaW5nKCkuaXNIYXNo VGFibGVEZWxldGVkVmFsdWUoKTsgfQogCkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCShyZXZpc2lvbiAxNDkyNTYp CisrKyBTb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwx OCBAQAorMjAxMy0wNC0yNyAgQWxleGV5IFByb3NrdXJ5YWtvdiAgPGFwQGFwcGxlLmNvbT4KKwor ICAgICAgICA8cmRhcjovL3Byb2JsZW0vMTM1NzQ3Mjk+IEltcGxlbWVudCBmaWxlIHBhdGggcmVz dHJpY3Rpb25zIGluIFdlYktpdCBPYmplY3RpdmUgQyBBUEkKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExNTMyMQorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogVUlQcm9jZXNzL0FQSS9DL1dLUGFnZS5jcHA6 CisgICAgICAgICogVUlQcm9jZXNzL0FQSS9DL1dLUGFnZS5oOgorICAgICAgICAqIFVJUHJvY2Vz cy9BUEkvbWFjL1dLQnJvd3NpbmdDb250ZXh0Q29udHJvbGxlci5tbToKKyAgICAgICAgKC1bV0tC cm93c2luZ0NvbnRleHRDb250cm9sbGVyIGxvYWRGaWxlVVJMOnJlc3RyaWN0VG9GaWxlc1dpdGhp bjpdKToKKyAgICAgICAgKiBVSVByb2Nlc3MvV2ViUGFnZVByb3h5LmNwcDoKKyAgICAgICAgKFdl YktpdDo6V2ViUGFnZVByb3h5Ojpsb2FkRmlsZSk6CisgICAgICAgICogVUlQcm9jZXNzL1dlYlBh Z2VQcm94eS5oOgorCiAyMDEzLTA0LTI3ICBKZXNzaWUgQmVybGluICA8amJlcmxpbkBhcHBsZS5j b20+CiAKICAgICAgICAgQnVpbGQgZml4LgpJbmRleDogU291cmNlL1dlYktpdDIvVUlQcm9jZXNz L1dlYlBhZ2VQcm94eS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdDIvVUlQcm9jZXNz L1dlYlBhZ2VQcm94eS5jcHAJKHJldmlzaW9uIDE0OTI1MikKKysrIFNvdXJjZS9XZWJLaXQyL1VJ UHJvY2Vzcy9XZWJQYWdlUHJveHkuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC03MzEsNiArNzMxLDIw IEBAIHZvaWQgV2ViUGFnZVByb3h5Ojpsb2FkV2ViQXJjaGl2ZURhdGEoY28KICAgICBtX3Byb2Nl c3MtPnJlc3BvbnNpdmVuZXNzVGltZXIoKS0+c3RhcnQoKTsKIH0KIAordm9pZCBXZWJQYWdlUHJv eHk6OmxvYWRGaWxlKGNvbnN0IFN0cmluZyYgcGF0aCwgY29uc3QgU3RyaW5nJiByZXNvdXJjZVJv b3RQYXRoKQoreworICAgIGlmICghaXNWYWxpZCgpKQorICAgICAgICByZWF0dGFjaFRvV2ViUHJv Y2VzcygpOworCisgICAgU3RyaW5nIGVmZmVjdGl2ZVJlc291cmNlUm9vdFBhdGggPSByZXNvdXJj ZVJvb3RQYXRoLmlzTnVsbCgpID8gIi8iIDogcmVzb3VyY2VSb290UGF0aDsKKworICAgIFNhbmRi b3hFeHRlbnNpb246OkhhbmRsZSBzYW5kYm94RXh0ZW5zaW9uSGFuZGxlOworICAgIFNhbmRib3hF eHRlbnNpb246OmNyZWF0ZUhhbmRsZShlZmZlY3RpdmVSZXNvdXJjZVJvb3RQYXRoLCBTYW5kYm94 RXh0ZW5zaW9uOjpSZWFkT25seSwgc2FuZGJveEV4dGVuc2lvbkhhbmRsZSk7CisgICAgbV9wcm9j ZXNzLT5hc3N1bWVSZWFkQWNjZXNzVG9CYXNlVVJMKGVmZmVjdGl2ZVJlc291cmNlUm9vdFBhdGgp OworICAgIG1fcHJvY2Vzcy0+c2VuZChNZXNzYWdlczo6V2ViUGFnZTo6TG9hZFVSTChLVVJMOjpm cm9tRmlsZVN5c3RlbVBhdGgocGF0aCksIHNhbmRib3hFeHRlbnNpb25IYW5kbGUpLCBtX3BhZ2VJ RCk7CisgICAgbV9wcm9jZXNzLT5yZXNwb25zaXZlbmVzc1RpbWVyKCktPnN0YXJ0KCk7Cit9CisK IHZvaWQgV2ViUGFnZVByb3h5OjpzdG9wTG9hZGluZygpCiB7CiAgICAgaWYgKCFpc1ZhbGlkKCkp CkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvV2ViUGFnZVByb3h5LmgKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gU291cmNlL1dlYktpdDIvVUlQcm9jZXNzL1dlYlBhZ2VQcm94eS5oCShyZXZpc2lvbiAx NDkyNTIpCisrKyBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvV2ViUGFnZVByb3h5LmgJKHdvcmtp bmcgY29weSkKQEAgLTI4OCw2ICsyODgsNyBAQCBwdWJsaWM6CiAgICAgdm9pZCBsb2FkQWx0ZXJu YXRlSFRNTFN0cmluZyhjb25zdCBTdHJpbmcmIGh0bWxTdHJpbmcsIGNvbnN0IFN0cmluZyYgYmFz ZVVSTCwgY29uc3QgU3RyaW5nJiB1bnJlYWNoYWJsZVVSTCk7CiAgICAgdm9pZCBsb2FkUGxhaW5U ZXh0U3RyaW5nKGNvbnN0IFN0cmluZyYgc3RyaW5nKTsKICAgICB2b2lkIGxvYWRXZWJBcmNoaXZl RGF0YShjb25zdCBXZWJEYXRhKik7CisgICAgdm9pZCBsb2FkRmlsZShjb25zdCBTdHJpbmcmIHBh dGgsIGNvbnN0IFN0cmluZyYgcmVzb3VyY2VSb290UGF0aCk7CiAKICAgICB2b2lkIHN0b3BMb2Fk aW5nKCk7CiAgICAgdm9pZCByZWxvYWQoYm9vbCByZWxvYWRGcm9tT3JpZ2luKTsKSW5kZXg6IFNv dXJjZS9XZWJLaXQyL1VJUHJvY2Vzcy9BUEkvQy9XS1BhZ2UuY3BwCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv dXJjZS9XZWJLaXQyL1VJUHJvY2Vzcy9BUEkvQy9XS1BhZ2UuY3BwCShyZXZpc2lvbiAxNDkyNTIp CisrKyBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJL0MvV0tQYWdlLmNwcAkod29ya2luZyBj b3B5KQpAQCAtOTIsNiArOTIsMTEgQEAgdm9pZCBXS1BhZ2VMb2FkV2ViQXJjaGl2ZURhdGEoV0tQ YWdlUmVmIAogICAgIHRvSW1wbChwYWdlUmVmKS0+bG9hZFdlYkFyY2hpdmVEYXRhKHRvSW1wbCh3 ZWJBcmNoaXZlRGF0YVJlZikpOwogfQogCit2b2lkIFdLUGFnZUxvYWRGaWxlKFdLUGFnZVJlZiBw YWdlUmVmLCBXS1N0cmluZ1JlZiBwYXRoLCBXS1N0cmluZ1JlZiByZXNvdXJjZVJvb3RQYXRoKQor eworICAgIHRvSW1wbChwYWdlUmVmKS0+bG9hZEZpbGUodG9XVEZTdHJpbmcocGF0aCksIHRvV1RG U3RyaW5nKHJlc291cmNlUm9vdFBhdGgpKTsKK30KKwogdm9pZCBXS1BhZ2VTdG9wTG9hZGluZyhX S1BhZ2VSZWYgcGFnZVJlZikKIHsKICAgICB0b0ltcGwocGFnZVJlZiktPnN0b3BMb2FkaW5nKCk7 CkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJL0MvV0tQYWdlLmgKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gU291cmNlL1dlYktpdDIvVUlQcm9jZXNzL0FQSS9DL1dLUGFnZS5oCShyZXZpc2lvbiAx NDkyNTIpCisrKyBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJL0MvV0tQYWdlLmgJKHdvcmtp bmcgY29weSkKQEAgLTM2Miw2ICszNjIsNyBAQCBXS19FWFBPUlQgdm9pZCBXS1BhZ2VMb2FkSFRN TFN0cmluZyhXS1BhCiBXS19FWFBPUlQgdm9pZCBXS1BhZ2VMb2FkQWx0ZXJuYXRlSFRNTFN0cmlu ZyhXS1BhZ2VSZWYgcGFnZSwgV0tTdHJpbmdSZWYgaHRtbFN0cmluZywgV0tVUkxSZWYgYmFzZVVS TCwgV0tVUkxSZWYgdW5yZWFjaGFibGVVUkwpOwogV0tfRVhQT1JUIHZvaWQgV0tQYWdlTG9hZFBs YWluVGV4dFN0cmluZyhXS1BhZ2VSZWYgcGFnZSwgV0tTdHJpbmdSZWYgcGxhaW5UZXh0U3RyaW5n KTsKIFdLX0VYUE9SVCB2b2lkIFdLUGFnZUxvYWRXZWJBcmNoaXZlRGF0YShXS1BhZ2VSZWYgcGFn ZSwgV0tEYXRhUmVmIHdlYkFyY2hpdmVEYXRhKTsKK1dLX0VYUE9SVCB2b2lkIFdLUGFnZUxvYWRG aWxlKFdLUGFnZVJlZiBwYWdlLCBXS1N0cmluZ1JlZiBwYXRoLCBXS1N0cmluZ1JlZiByZXNvdXJj ZVJvb3RQYXRoKTsKIAogV0tfRVhQT1JUIHZvaWQgV0tQYWdlU3RvcExvYWRpbmcoV0tQYWdlUmVm IHBhZ2UpOwogV0tfRVhQT1JUIHZvaWQgV0tQYWdlUmVsb2FkKFdLUGFnZVJlZiBwYWdlKTsKSW5k ZXg6IFNvdXJjZS9XZWJLaXQyL1VJUHJvY2Vzcy9BUEkvbWFjL1dLQnJvd3NpbmdDb250ZXh0Q29u dHJvbGxlci5tbQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJL21h Yy9XS0Jyb3dzaW5nQ29udGV4dENvbnRyb2xsZXIubW0JKHJldmlzaW9uIDE0OTI1MikKKysrIFNv dXJjZS9XZWJLaXQyL1VJUHJvY2Vzcy9BUEkvbWFjL1dLQnJvd3NpbmdDb250ZXh0Q29udHJvbGxl ci5tbQkod29ya2luZyBjb3B5KQpAQCAtMTIxLDExICsxMjEsMTUgQEAgLSAodm9pZClsb2FkRmls ZVVSTDooTlNVUkwgKilVUkwgcmVzdHJpYwogewogICAgIGlmICghW1VSTCBpc0ZpbGVVUkxdKQog ICAgICAgICByZXR1cm47CisgICAgaWYgKGFsbG93ZWREaXJlY3RvcnkgJiYgIVthbGxvd2VkRGly ZWN0b3J5IGlzRmlsZVVSTF0pCisgICAgICAgIHJldHVybjsKIAotICAgIC8qIEZJWE1FOiBJbXBs ZW1lbnQgcmVzdHJpY3Rpb25zLiAqLwotCi0gICAgV0tSZXRhaW5QdHI8V0tVUkxSZWY+IHdrVVJM ID0gYWRvcHRXSyhXS1VSTENyZWF0ZVdpdGhDRlVSTCgoQ0ZVUkxSZWYpVVJMKSk7Ci0gICAgV0tQ YWdlTG9hZFVSTChzZWxmLl9wYWdlUmVmLCB3a1VSTC5nZXQoKSk7CisgICAgV0tSZXRhaW5QdHI8 V0tTdHJpbmdSZWY+IHBhdGggPSBhZG9wdFdLKFdLU3RyaW5nQ3JlYXRlV2l0aENGU3RyaW5nKChD RlN0cmluZ1JlZilbVVJMIHBhdGhdKSk7CisgICAgV0tSZXRhaW5QdHI8V0tTdHJpbmdSZWY+IHJl c291cmNlUm9vdFBhdGg7CisgICAgaWYgKGFsbG93ZWREaXJlY3RvcnkpCisgICAgICAgIHJlc291 cmNlUm9vdFBhdGggPSBhZG9wdFdLKFdLU3RyaW5nQ3JlYXRlV2l0aENGU3RyaW5nKChDRlN0cmlu Z1JlZilbYWxsb3dlZERpcmVjdG9yeSBwYXRoXSkpOworICAgIAorICAgIFdLUGFnZUxvYWRGaWxl KHNlbGYuX3BhZ2VSZWYsIHBhdGguZ2V0KCksIHJlc291cmNlUm9vdFBhdGguZ2V0KCkpOwogfQog CiAtICh2b2lkKWxvYWRIVE1MU3RyaW5nOihOU1N0cmluZyAqKUhUTUxTdHJpbmcgYmFzZVVSTDoo TlNVUkwgKiliYXNlVVJMCg== 199984 2013-04-28 23:05:45 -0700 2013-04-29 08:40:06 -0700 proposed patch RestrictToDirectory.txt text/plain 6720 ap SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDE0OTI2NykKKysrIFNvdXJjZS9XZWJLaXQyL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI0IEBACisyMDEzLTA0LTI4ICBBbGV4ZXkg UHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29tPgorCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8x MzU3NDcyOT4gSW1wbGVtZW50IGZpbGUgcGF0aCByZXN0cmljdGlvbnMgaW4gV2ViS2l0IE9iamVj dGl2ZSBDIEFQSQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9MTE1MzIxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgKiBVSVByb2Nlc3MvQVBJL0MvV0tQYWdlLmNwcDoKKyAgICAgICAgKiBVSVByb2Nlc3MvQVBJ L0MvV0tQYWdlLmg6IAorICAgICAgICAqIFVJUHJvY2Vzcy9XZWJQYWdlUHJveHkuY3BwOiAoV2Vi S2l0OjpXZWJQYWdlUHJveHk6OmxvYWRGaWxlKToKKyAgICAgICAgKiBVSVByb2Nlc3MvV2ViUGFn ZVByb3h5Lmg6CisgICAgICAgIEFkZGVkIGFuZCBpbXBsZW1lbnRlZCBhIEMgQVBJIHRvIGxvYWQg YSBmaWxlIHdoaWxlIG9ubHkgb3BlbmluZyBzYW5kYm94IGZvcgorICAgICAgICBhIHNwZWNpZmlj IGRpcmVjdG9yeS4KKworICAgICAgICAqIFVJUHJvY2Vzcy9BUEkvbWFjL1dLQnJvd3NpbmdDb250 ZXh0Q29udHJvbGxlci5oOiBGaXhlZCBhIHR5cG8gaW4gYSBjb21tZW50LgorCisgICAgICAgICog VUlQcm9jZXNzL0FQSS9tYWMvV0tCcm93c2luZ0NvbnRleHRDb250cm9sbGVyLm1tOgorICAgICAg ICAoLVtXS0Jyb3dzaW5nQ29udGV4dENvbnRyb2xsZXIgbG9hZEZpbGVVUkw6cmVzdHJpY3RUb0Zp bGVzV2l0aGluOl0pOgorICAgICAgICBSZXNwZWN0IGFsbG93ZWREaXJlY3RvcnkgYXJndW1lbnQu IFVwZGF0ZWQgdGhlIGZ1bmN0aW9uIHRvIHJhaXNlIGFuIGV4Y2VwdGlvbiBmb3IKKyAgICAgICAg aW5jb3JyZWN0IGlucHV0LCBhcyBkZWNyaWJlZCBpbiBoZWFkZXIgZmlsZS4KKwogMjAxMy0wNC0y OCAgR3l1eW91bmcgS2ltICA8Z3l1eW91bmcua2ltQHNhbXN1bmcuY29tPgogCiAgICAgICAgIFVu cmV2aWV3ZWQgZml4IGJ1aWxkIGJyZWFrIG9uIEVGTCBwb3J0IHNpbmNlIHIxNDkyNTkuCkluZGV4 OiBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvV2ViUGFnZVByb3h5LmNwcAo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t LSBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvV2ViUGFnZVByb3h5LmNwcAkocmV2aXNpb24gMTQ5 MjUyKQorKysgU291cmNlL1dlYktpdDIvVUlQcm9jZXNzL1dlYlBhZ2VQcm94eS5jcHAJKHdvcmtp bmcgY29weSkKQEAgLTczMSw2ICs3MzEsMzIgQEAgdm9pZCBXZWJQYWdlUHJveHk6OmxvYWRXZWJB cmNoaXZlRGF0YShjbwogICAgIG1fcHJvY2Vzcy0+cmVzcG9uc2l2ZW5lc3NUaW1lcigpLT5zdGFy dCgpOwogfQogCit2b2lkIFdlYlBhZ2VQcm94eTo6bG9hZEZpbGUoY29uc3QgU3RyaW5nJiBmaWxl VVJMU3RyaW5nLCBjb25zdCBTdHJpbmcmIHJlc291cmNlRGlyZWN0b3J5VVJMU3RyaW5nKQorewor ICAgIGlmICghaXNWYWxpZCgpKQorICAgICAgICByZWF0dGFjaFRvV2ViUHJvY2VzcygpOworCisg ICAgS1VSTCBmaWxlVVJMID0gS1VSTChLVVJMKCksIGZpbGVVUkxTdHJpbmcpOworICAgIGlmICgh ZmlsZVVSTC5pc0xvY2FsRmlsZSgpKQorICAgICAgICByZXR1cm47CisKKyAgICBLVVJMIHJlc291 cmNlRGlyZWN0b3J5VVJMOworICAgIGlmICghcmVzb3VyY2VEaXJlY3RvcnlVUkxTdHJpbmcuaXNO dWxsKCkpIHsKKyAgICAgICAgcmVzb3VyY2VEaXJlY3RvcnlVUkwgPSBLVVJMKEtVUkwoKSwgcmVz b3VyY2VEaXJlY3RvcnlVUkxTdHJpbmcpOworICAgICAgICBpZiAoIXJlc291cmNlRGlyZWN0b3J5 VVJMLmlzTG9jYWxGaWxlKCkpCisgICAgICAgICAgICByZXR1cm47CisgICAgfSBlbHNlCisgICAg ICAgIHJlc291cmNlRGlyZWN0b3J5VVJMID0gS1VSTChQYXJzZWRVUkxTdHJpbmcsICJmaWxlOi8v LyIpOworCisgICAgU3RyaW5nIHJlc291cmNlRGlyZWN0b3J5UGF0aCA9IHJlc291cmNlRGlyZWN0 b3J5VVJMLmZpbGVTeXN0ZW1QYXRoKCk7CisKKyAgICBTYW5kYm94RXh0ZW5zaW9uOjpIYW5kbGUg c2FuZGJveEV4dGVuc2lvbkhhbmRsZTsKKyAgICBTYW5kYm94RXh0ZW5zaW9uOjpjcmVhdGVIYW5k bGUocmVzb3VyY2VEaXJlY3RvcnlQYXRoLCBTYW5kYm94RXh0ZW5zaW9uOjpSZWFkT25seSwgc2Fu ZGJveEV4dGVuc2lvbkhhbmRsZSk7CisgICAgbV9wcm9jZXNzLT5hc3N1bWVSZWFkQWNjZXNzVG9C YXNlVVJMKHJlc291cmNlRGlyZWN0b3J5UGF0aCk7CisgICAgbV9wcm9jZXNzLT5zZW5kKE1lc3Nh Z2VzOjpXZWJQYWdlOjpMb2FkVVJMKGZpbGVVUkwsIHNhbmRib3hFeHRlbnNpb25IYW5kbGUpLCBt X3BhZ2VJRCk7CisgICAgbV9wcm9jZXNzLT5yZXNwb25zaXZlbmVzc1RpbWVyKCktPnN0YXJ0KCk7 Cit9CisKIHZvaWQgV2ViUGFnZVByb3h5OjpzdG9wTG9hZGluZygpCiB7CiAgICAgaWYgKCFpc1Zh bGlkKCkpCkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvV2ViUGFnZVByb3h5LmgKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL1dlYktpdDIvVUlQcm9jZXNzL1dlYlBhZ2VQcm94eS5oCShyZXZp c2lvbiAxNDkyNTIpCisrKyBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvV2ViUGFnZVByb3h5LmgJ KHdvcmtpbmcgY29weSkKQEAgLTI4OCw2ICsyODgsNyBAQCBwdWJsaWM6CiAgICAgdm9pZCBsb2Fk QWx0ZXJuYXRlSFRNTFN0cmluZyhjb25zdCBTdHJpbmcmIGh0bWxTdHJpbmcsIGNvbnN0IFN0cmlu ZyYgYmFzZVVSTCwgY29uc3QgU3RyaW5nJiB1bnJlYWNoYWJsZVVSTCk7CiAgICAgdm9pZCBsb2Fk UGxhaW5UZXh0U3RyaW5nKGNvbnN0IFN0cmluZyYgc3RyaW5nKTsKICAgICB2b2lkIGxvYWRXZWJB cmNoaXZlRGF0YShjb25zdCBXZWJEYXRhKik7CisgICAgdm9pZCBsb2FkRmlsZShjb25zdCBTdHJp bmcmIGZpbGVVUkwsIGNvbnN0IFN0cmluZyYgcmVzb3VyY2VEaXJlY3RvcnlVUkwpOwogCiAgICAg dm9pZCBzdG9wTG9hZGluZygpOwogICAgIHZvaWQgcmVsb2FkKGJvb2wgcmVsb2FkRnJvbU9yaWdp bik7CkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJL0MvV0tQYWdlLmNwcAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJL0MvV0tQYWdlLmNwcAkocmV2 aXNpb24gMTQ5MjUyKQorKysgU291cmNlL1dlYktpdDIvVUlQcm9jZXNzL0FQSS9DL1dLUGFnZS5j cHAJKHdvcmtpbmcgY29weSkKQEAgLTkyLDYgKzkyLDExIEBAIHZvaWQgV0tQYWdlTG9hZFdlYkFy Y2hpdmVEYXRhKFdLUGFnZVJlZiAKICAgICB0b0ltcGwocGFnZVJlZiktPmxvYWRXZWJBcmNoaXZl RGF0YSh0b0ltcGwod2ViQXJjaGl2ZURhdGFSZWYpKTsKIH0KIAordm9pZCBXS1BhZ2VMb2FkRmls ZShXS1BhZ2VSZWYgcGFnZVJlZiwgV0tVUkxSZWYgZmlsZVVSTCwgV0tVUkxSZWYgcmVzb3VyY2VE aXJlY3RvcnlVUkwpCit7CisgICAgdG9JbXBsKHBhZ2VSZWYpLT5sb2FkRmlsZSh0b1dURlN0cmlu ZyhmaWxlVVJMKSwgdG9XVEZTdHJpbmcocmVzb3VyY2VEaXJlY3RvcnlVUkwpKTsKK30KKwogdm9p ZCBXS1BhZ2VTdG9wTG9hZGluZyhXS1BhZ2VSZWYgcGFnZVJlZikKIHsKICAgICB0b0ltcGwocGFn ZVJlZiktPnN0b3BMb2FkaW5nKCk7CkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJ L0MvV0tQYWdlLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdDIvVUlQcm9jZXNzL0FQSS9D L1dLUGFnZS5oCShyZXZpc2lvbiAxNDkyNTIpCisrKyBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3Mv QVBJL0MvV0tQYWdlLmgJKHdvcmtpbmcgY29weSkKQEAgLTM2Miw2ICszNjIsNyBAQCBXS19FWFBP UlQgdm9pZCBXS1BhZ2VMb2FkSFRNTFN0cmluZyhXS1BhCiBXS19FWFBPUlQgdm9pZCBXS1BhZ2VM b2FkQWx0ZXJuYXRlSFRNTFN0cmluZyhXS1BhZ2VSZWYgcGFnZSwgV0tTdHJpbmdSZWYgaHRtbFN0 cmluZywgV0tVUkxSZWYgYmFzZVVSTCwgV0tVUkxSZWYgdW5yZWFjaGFibGVVUkwpOwogV0tfRVhQ T1JUIHZvaWQgV0tQYWdlTG9hZFBsYWluVGV4dFN0cmluZyhXS1BhZ2VSZWYgcGFnZSwgV0tTdHJp bmdSZWYgcGxhaW5UZXh0U3RyaW5nKTsKIFdLX0VYUE9SVCB2b2lkIFdLUGFnZUxvYWRXZWJBcmNo aXZlRGF0YShXS1BhZ2VSZWYgcGFnZSwgV0tEYXRhUmVmIHdlYkFyY2hpdmVEYXRhKTsKK1dLX0VY UE9SVCB2b2lkIFdLUGFnZUxvYWRGaWxlKFdLUGFnZVJlZiBwYWdlLCBXS1VSTFJlZiBmaWxlVVJM LCBXS1VSTFJlZiByZXNvdXJjZURpcmVjdG9yeVVSTCk7CiAKIFdLX0VYUE9SVCB2b2lkIFdLUGFn ZVN0b3BMb2FkaW5nKFdLUGFnZVJlZiBwYWdlKTsKIFdLX0VYUE9SVCB2b2lkIFdLUGFnZVJlbG9h ZChXS1BhZ2VSZWYgcGFnZSk7CkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJL21h Yy9XS0Jyb3dzaW5nQ29udGV4dENvbnRyb2xsZXIuaAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9VSVByb2Nlc3MvQVBJL21hYy9XS0Jyb3dzaW5nQ29udGV4dENvbnRyb2xsZXIuaAkocmV2 aXNpb24gMTQ5MjUyKQorKysgU291cmNlL1dlYktpdDIvVUlQcm9jZXNzL0FQSS9tYWMvV0tCcm93 c2luZ0NvbnRleHRDb250cm9sbGVyLmgJKHdvcmtpbmcgY29weSkKQEAgLTUwLDkgKzUwLDkgQEAg QGludGVyZmFjZSBXS0Jyb3dzaW5nQ29udGV4dENvbnRyb2xsZXIgOgogLSAodm9pZClsb2FkUmVx dWVzdDooTlNVUkxSZXF1ZXN0ICopcmVxdWVzdDsKIAogLyogTG9hZCBhIGZpbGU6IFVSTC4gT3Bl bnMgdGhlIHNhbmRib3ggb25seSBmb3IgZmlsZXMgd2l0aGluIGFsbG93ZWREaXJlY3RvcnkuCi0g ICAgLSBQYXNzaW5nIGEgbm9uLWZpbGU6IFVSTCB0byBlaXRoZXIgcGFyYW1ldGVyIHdpbGwgeWVp bGQgYW4gZXhjZXB0aW9uLgorICAgIC0gUGFzc2luZyBhIG5vbi1maWxlOiBVUkwgdG8gZWl0aGVy IHBhcmFtZXRlciB3aWxsIHlpZWxkIGFuIGV4Y2VwdGlvbi4KICAgICAtIFBhc3NpbmcgbmlsIGFz IHRoZSBhbGxvd2VkRGlyZWN0b3J5IHdpbGwgb3BlbiB0aGUgZW50aXJlIGZpbGUtc3lzdGVtIGZv cgotICAgICAgcmVhZGluZy4gCisgICAgICByZWFkaW5nLgogKi8KIC0gKHZvaWQpbG9hZEZpbGVV Ukw6KE5TVVJMICopVVJMIHJlc3RyaWN0VG9GaWxlc1dpdGhpbjooTlNVUkwgKilhbGxvd2VkRGly ZWN0b3J5OwogCkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJL21hYy9XS0Jyb3dz aW5nQ29udGV4dENvbnRyb2xsZXIubW0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdDIvVUlQ cm9jZXNzL0FQSS9tYWMvV0tCcm93c2luZ0NvbnRleHRDb250cm9sbGVyLm1tCShyZXZpc2lvbiAx NDkyNTIpCisrKyBTb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvQVBJL21hYy9XS0Jyb3dzaW5nQ29u dGV4dENvbnRyb2xsZXIubW0JKHdvcmtpbmcgY29weSkKQEAgLTExOSwxMyArMTE5LDEzIEBAIC0g KHZvaWQpbG9hZFJlcXVlc3Q6KE5TVVJMUmVxdWVzdCAqKXJlcXUKIAogLSAodm9pZClsb2FkRmls ZVVSTDooTlNVUkwgKilVUkwgcmVzdHJpY3RUb0ZpbGVzV2l0aGluOihOU1VSTCAqKWFsbG93ZWRE aXJlY3RvcnkKIHsKLSAgICBpZiAoIVtVUkwgaXNGaWxlVVJMXSkKLSAgICAgICAgcmV0dXJuOwot Ci0gICAgLyogRklYTUU6IEltcGxlbWVudCByZXN0cmljdGlvbnMuICovCisgICAgaWYgKCFbVVJM IGlzRmlsZVVSTF0gfHwgKGFsbG93ZWREaXJlY3RvcnkgJiYgIVthbGxvd2VkRGlyZWN0b3J5IGlz RmlsZVVSTF0pKQorICAgICAgICBbTlNFeGNlcHRpb24gcmFpc2U6TlNJbnZhbGlkQXJndW1lbnRF eGNlcHRpb24gZm9ybWF0OkAiQXR0ZW1wdGVkIHRvIGxvYWQgYSBub24tZmlsZSBVUkwiXTsKIAog ICAgIFdLUmV0YWluUHRyPFdLVVJMUmVmPiB3a1VSTCA9IGFkb3B0V0soV0tVUkxDcmVhdGVXaXRo Q0ZVUkwoKENGVVJMUmVmKVVSTCkpOwotICAgIFdLUGFnZUxvYWRVUkwoc2VsZi5fcGFnZVJlZiwg d2tVUkwuZ2V0KCkpOworICAgIFdLUmV0YWluUHRyPFdLVVJMUmVmPiB3a0FsbG93ZWREaXJlY3Rv cnkgPSBhZG9wdFdLKFdLVVJMQ3JlYXRlV2l0aENGVVJMKChDRlVSTFJlZilhbGxvd2VkRGlyZWN0 b3J5KSk7CisgICAgCisgICAgV0tQYWdlTG9hZEZpbGUoc2VsZi5fcGFnZVJlZiwgd2tVUkwuZ2V0 KCksIHdrQWxsb3dlZERpcmVjdG9yeS5nZXQoKSk7CiB9CiAKIC0gKHZvaWQpbG9hZEhUTUxTdHJp bmc6KE5TU3RyaW5nICopSFRNTFN0cmluZyBiYXNlVVJMOihOU1VSTCAqKWJhc2VVUkwK