16775 2008-01-07 12:26:12 -0800 Security exploit in postMessage using js to override the URI and domain 2008-01-20 15:25:54 -0800 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) All All RESOLVED FIXED http://crypto.stanford.edu/~abarth/research/webkit/base/ P1 Normal --- 1 abarth sam ap collinj darin ian sam oldest_to_newest 66483 0 abarth 2008-01-07 12:26:12 -0800 If an HTML document contains a <base> tag, the value of its href attribute overwrites the value of document.documentURI. This is inconsistent with the other two browsers that implement documentURI, Firefox and Opera. Also, JavaScript should not be able to overwrite the value of document.documentURI. This bug has some security consequences. For example, an attacker can set the uri parameter of postMessage to an arbitrary URI, defeating any security checks using uri. The uri parameter is important for distinguishing between HTTP and HTTPS as well as determining whether the sender's host is different from its document.domain value. (Not filing as security sensitive because postMessage appears to be the only WebCore consumer of this API and hasn't shipped yet.) 66513 1 sam 2008-01-07 19:18:49 -0800 Overwriting of document.documentURI seems to be allowed by the DOM 3 Core spec (http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/core.html#Document3-documentURI). That is not say we shouldn't change our behavior to match the other browsers, though I can't imagine that we would want to unless it poses a real security or compatibility concern. That said, I am not sure our doucment.documentURI implementation is correct. For this bug, I think the fix is to not use the Document::documentURI() for postMessage, but rather use the url from the FrameLoader (or perhaps one of the other 10 url related methods off the document, uhg). 66525 2 abarth 2008-01-07 21:45:13 -0800 > Overwriting of document.documentURI seems to be allowed by the DOM 3 Core spec Yep. You're right. Firefox throws a "not implemented" exception when you try to assign to documentURI, which we originally took to mean it wasn't assignable. > I am not sure our doucment.documentURI implementation is correct. I think it is not meant to be affected by the <base> tag. For example, the spec says: "the base URI is computed using first the value of the href attribute of the HTML BASE element if any, and the value of the documentURI attribute from the Document interface otherwise" [1], which implies that the two aren't necessarily equal. > For this bug, I think the fix is to not use the Document::documentURI() for > postMessage, but rather use the url from the FrameLoader That makes sense. The HTML5 spec should probably be clarified because it saids: "the uri attribute must be set to the URI of that document" [2], which sounds a lot like document.documentURI. [1] http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/core.html#Node3-baseURI [2] http://www.whatwg.org/specs/web-apps/current-work/#postmessage 66555 3 darin 2008-01-08 09:47:01 -0800 I am calling this a P1 bug, because we have to either fix it or remove postMessage to avoid creating a security problem. 66597 4 18336 collinj 2008-01-08 17:26:06 -0800 Created attachment 18336 Adds integrity to postMessage URI > For this bug, I think the fix is to not use the > Document::documentURI() for postMessage, but rather > use the url from the FrameLoader (or perhaps one of the > other 10 url related methods off the document, uhg). This patch changes postMessage to use the same URL field as document.location. 66598 5 18336 darin 2008-01-08 17:29:18 -0800 Comment on attachment 18336 Adds integrity to postMessage URI Good patch! r=me However, it does not fix this bug as described in the title. It fixes the more important security problem in postMessage. 67003 6 18404 collinj 2008-01-11 20:05:43 -0800 Created attachment 18404 Updated patch with more tests and updated document.domain behavior The HTML5 spec has been clarified to specify that the domain value should not change when the page sets document.domain. This updated patch changes the browser behavior to match the new spec. There's a new test case as well. 67622 7 abarth 2008-01-18 14:05:08 -0800 It looks like this patch has been r+'ed since Jan 12 but has not been landed. Is there something we can do on our end to help? 67627 8 sam 2008-01-18 14:28:11 -0800 Oops, that is my fault. I will land it ASAP. Sorry. 67794 9 sam 2008-01-20 15:19:59 -0800 Fix landed in r29678. 67795 10 sam 2008-01-20 15:22:35 -0800 I am going to close this bug and open another to track the original issue, the base tag overwrites document.documentURI. 67797 11 sam 2008-01-20 15:25:54 -0800 Filed bug 16950 as a follow up. 18336 2008-01-08 17:26:06 -0800 2008-01-13 11:26:33 -0800 Adds integrity to postMessage URI post-message.collinj.patch text/plain 6769 collinj SW5kZXg6IFdlYkNvcmUvYmluZGluZ3MvanMvSlNET01XaW5kb3dDdXN0b20uY3BwCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFdlYkNvcmUvYmluZGluZ3MvanMvSlNET01XaW5kb3dDdXN0b20uY3BwCShyZXZpc2lv biAyOTMyMSkKKysrIFdlYkNvcmUvYmluZGluZ3MvanMvSlNET01XaW5kb3dDdXN0b20uY3BwCSh3 b3JraW5nIGNvcHkpCkBAIC0yMyw2ICsyMyw4IEBACiAjaW5jbHVkZSAiRG9jdW1lbnQuaCIKICNp bmNsdWRlICJET01XaW5kb3cuaCIKICNpbmNsdWRlICJFeGNlcHRpb25Db2RlLmgiCisjaW5jbHVk ZSAiRnJhbWUuaCIKKyNpbmNsdWRlICJGcmFtZUxvYWRlci5oIgogI2luY2x1ZGUgImtqc193aW5k b3cuaCIKICNpbmNsdWRlICJranMvb2JqZWN0LmgiCiAjaW5jbHVkZSAia2pzL3ZhbHVlLmgiCkBA IC0xMTgsOCArMTIwLDggQEAKICAgICBET01XaW5kb3cqIHdpbmRvdyA9IGltcGwoKTsKICAgICAK ICAgICBET01XaW5kb3cqIHNvdXJjZSA9IHN0YXRpY19jYXN0PEpTRE9NV2luZG93Kj4oZXhlYy0+ ZHluYW1pY0dsb2JhbE9iamVjdCgpKS0+aW1wbCgpOwotICAgIFN0cmluZyBkb21haW4gPSBzb3Vy Y2UtPmRvY3VtZW50KCktPnNlY3VyaXR5T3JpZ2luKCktPmRvbWFpbigpOwotICAgIFN0cmluZyB1 cmkgPSBzb3VyY2UtPmRvY3VtZW50KCktPmRvY3VtZW50VVJJKCk7CisgICAgU3RyaW5nIGRvbWFp biA9IHNvdXJjZS0+ZG9jdW1lbnQoKS0+ZG9tYWluKCk7CisgICAgU3RyaW5nIHVyaSA9IHNvdXJj ZS0+ZnJhbWUoKS0+bG9hZGVyKCktPnVybCgpLnN0cmluZygpOwogICAgIFN0cmluZyBtZXNzYWdl ID0gYXJnc1swXS0+dG9TdHJpbmcoZXhlYyk7CiAgICAgCiAgICAgaWYgKGV4ZWMtPmhhZEV4Y2Vw dGlvbigpKQpJbmRleDogV2ViQ29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9D aGFuZ2VMb2cJKHJldmlzaW9uIDI5MzIxKQorKysgV2ViQ29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcg Y29weSkKQEAgLTEsMyArMSwyMCBAQAorMjAwOC0wMS0wOCAgQWRhbSBCYXJ0aCAgPGhrOTU2NUBn bWFpbC5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgUGFydGlhbCBmaXggZm9yIGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTE2Nzc1CisKKyAgICAgICAgV2Ugbm93IHVzZSBmcmFtZSgpLT5sb2FkZXIoKS0+dXJsKCkgZm9y IHBvc3RNZXNzYWdlLCBwcmV2ZW50aW5nIGEKKyAgICAgICAgbWFsaWNpb3VzIHNlbmRlciBmcm9t IG92ZXJ3cml0aW5nIHRoZSB1cmkgcHJvcGVydHkuICBBbHNvLCB1c2UKKyAgICAgICAgZG9jdW1l bnQoKS0+ZG9tYWluKCkgaW5zdGVhZCBvZiBkb2N1bWVudCgpLT5TZWN1cml0eU9yaWdpbigpLT5k b21haW4oKQorICAgICAgICB0byBhYnN0cmFjdCBhd2F5IGRldGFpbHMgb2YgdGhlIGltcGxlbWVu dGF0aW9uIG9mIERvY3VtZW50LgorCisgICAgICAgIFRlc3RzOiBodHRwL3Rlc3RzL3NlY3VyaXR5 L3Bvc3RNZXNzYWdlL2RvbWFpbi1hZmZlY3RlZC1ieS1kb2N1bWVudC1kb21haW4uaHRtbAorICAg ICAgICAgICAgICAgaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4tYW5kLXVy aS11bmFmZmVjdGVkLWJ5LWJhc2UtdGFnLmh0bWwKKworICAgICAgICAqIGJpbmRpbmdzL2pzL0pT RE9NV2luZG93Q3VzdG9tLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkpTRE9NV2luZG93Ojpwb3N0 TWVzc2FnZSk6CisKIDIwMDgtMDEtMDggIERhbiBCZXJuc3RlaW4gIDxtaXR6QGFwcGxlLmNvbT4K IAogICAgICAgICBSdWJiZXItc3RhbXBlZCBieSBTYW0gV2VpbmlnLgpJbmRleDogTGF5b3V0VGVz dHMvaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4tYWZmZWN0ZWQtYnktZG9j dW1lbnQtZG9tYWluLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9z ZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4tYWZmZWN0ZWQtYnktZG9jdW1lbnQtZG9tYWluLmh0 bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Bvc3RN ZXNzYWdlL2RvbWFpbi1hZmZlY3RlZC1ieS1kb2N1bWVudC1kb21haW4uaHRtbAkocmV2aXNpb24g MCkKQEAgLTAsMCArMSwzNiBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxoZWFkPgorPHNj cmlwdD4KK2lmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpIHsKKyAgICBsYXlvdXRUZXN0 Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7CisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIud2FpdFVu dGlsRG9uZSgpOworfQorCitmdW5jdGlvbiByZWN2KGUpIHsKKyAgICBpZiAod2luZG93LmxheW91 dFRlc3RDb250cm9sbGVyKQorICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5ub3RpZnlEb25l KCk7CisKKyAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgicmVzdWx0IikuZmlyc3RDaGlsZC5k YXRhID0gZS5kYXRhOworfQorCitkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIiwg cmVjdiwgZmFsc2UpOworCitmdW5jdGlvbiB0ZXN0KCkgeworICAgIHZhciBpZnJhbWUgPSBkb2N1 bWVudC5nZXRFbGVtZW50QnlJZCgnY2hpbGQnKTsKKyAgICB2YXIgd2luID0gaWZyYW1lLmNvbnRl bnRXaW5kb3c7CisgICAgd2luLnBvc3RNZXNzYWdlKCdNZXNzYWdlIGZyb20gcGFyZW50Jyk7Cit9 CisKK2RvY3VtZW50LmRvbWFpbiA9ICIwLjAuMSI7Cis8L3NjcmlwdD4KKzxib2R5PgorPGRpdj53 aW5kb3cubG9jYXRpb24uaHJlZiA9IDxzY3JpcHQ+ZG9jdW1lbnQud3JpdGUoZG9jdW1lbnQubG9j YXRpb24uaHJlZik7PC9zY3JpcHQ+PC9kaXY+Cis8ZGl2PmRvY3VtZW50LmRvbWFpbiA9IDxzY3Jp cHQ+ZG9jdW1lbnQud3JpdGUoZG9jdW1lbnQuZG9tYWluKTs8L3NjcmlwdD48L2Rpdj4KKzxkaXY+ PGlmcmFtZSBzcmM9Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9zZWN1cml0eS9wb3N0TWVzc2FnZS9y ZXNvdXJjZXMvcG9zdC1tZXNzYWdlLWxpc3RlbmVyLmh0bWwiIGlkPSJjaGlsZCIgd2lkdGg9Ijgw MCIgaGVpZ2h0PSIzMDAiCisgIHN0eWxlPSJib3JkZXI6IDFweCBzb2xpZCBibGFjazsiIG9ubG9h ZD0idGVzdCgpIj4KKzwvaWZyYW1lPjwvZGl2PgorPGRpdiBpZD0icmVzdWx0Ij53YWl0aW5nLi4u PC9kaXY+Cis8L2JvZHk+Cis8L2h0bWw+CisKSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMv c2VjdXJpdHkvcG9zdE1lc3NhZ2UvZG9tYWluLWFuZC11cmktdW5hZmZlY3RlZC1ieS1iYXNlLXRh Zy5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9z dE1lc3NhZ2UvZG9tYWluLWFuZC11cmktdW5hZmZlY3RlZC1ieS1iYXNlLXRhZy5odG1sCShyZXZp c2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9k b21haW4tYW5kLXVyaS11bmFmZmVjdGVkLWJ5LWJhc2UtdGFnLmh0bWwJKHJldmlzaW9uIDApCkBA IC0wLDAgKzEsMzQgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQ+ CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKSB7CisgICAgbGF5b3V0VGVzdENvbnRy b2xsZXIuZHVtcEFzVGV4dCgpOworICAgIGxheW91dFRlc3RDb250cm9sbGVyLndhaXRVbnRpbERv bmUoKTsKK30KKworZnVuY3Rpb24gcmVjdihlKSB7CisgICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0 Q29udHJvbGxlcikKKyAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIubm90aWZ5RG9uZSgpOwor CisgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInJlc3VsdCIpLmZpcnN0Q2hpbGQuZGF0YSA9 IGUuZGF0YTsKK30KKworZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsIHJlY3Ys IGZhbHNlKTsKKworZnVuY3Rpb24gdGVzdCgpIHsKKyAgICB2YXIgaWZyYW1lID0gZG9jdW1lbnQu Z2V0RWxlbWVudEJ5SWQoJ2NoaWxkJyk7CisgICAgdmFyIHdpbj0gaWZyYW1lLmNvbnRlbnRXaW5k b3c7CisgICAgd2luLnBvc3RNZXNzYWdlKCdNZXNzYWdlIGZyb20gcGFyZW50Jyk7Cit9Cis8L3Nj cmlwdD4KKzxiYXNlIGhyZWY9Imh0dHA6Ly93d3cuZXhhbXBsZS5jb20vIj4KKzxib2R5PgorPGRp dj53aW5kb3cubG9jYXRpb24uaHJlZiA9IDxzY3JpcHQ+ZG9jdW1lbnQud3JpdGUoZG9jdW1lbnQu bG9jYXRpb24uaHJlZik7PC9zY3JpcHQ+PC9kaXY+Cis8ZGl2PjxpZnJhbWUgc3JjPSJodHRwOi8v bG9jYWxob3N0OjgwMDAvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvcmVzb3VyY2VzL3Bvc3QtbWVzc2Fn ZS1saXN0ZW5lci5odG1sIiBvbmxvYWQ9InRlc3QoKSIKKyAgaWQ9ImNoaWxkIiB3aWR0aD0iODAw IiBoZWlnaHQ9IjMwMCIgc3R5bGU9ImJvcmRlcjogMXB4IHNvbGlkIGJsYWNrOyI+Cis8L2lmcmFt ZT48L2Rpdj4KKzxkaXYgaWQ9InJlc3VsdCI+d2FpdGluZy4uLjwvZGl2PgorPC9ib2R5PgorPC9o dG1sPgorCkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Bvc3RNZXNzYWdl L3Jlc291cmNlcy9wb3N0LW1lc3NhZ2UtbGlzdGVuZXIuaHRtbAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlv dXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Bvc3RNZXNzYWdlL3Jlc291cmNlcy9wb3N0LW1l c3NhZ2UtbGlzdGVuZXIuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2h0dHAvdGVz dHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvcmVzb3VyY2VzL3Bvc3QtbWVzc2FnZS1saXN0ZW5lci5o dG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDEzIEBACis8aHRtbD4KKzxib2R5PgorPGRpdj53 aW5kb3cubG9jYXRpb24uaHJlZiA9IDxzY3JpcHQ+ZG9jdW1lbnQud3JpdGUoZG9jdW1lbnQubG9j YXRpb24uaHJlZik7PC9zY3JpcHQ+PC9kaXY+Cis8c2NyaXB0PgorZnVuY3Rpb24gcmVjdihlKSB7 CisgICAgdmFyIG1zZyA9ICdSZWNlaXZlZCBtZXNzYWdlOiBkYXRhPSInICsgZS5kYXRhICsgJyIg ZG9tYWluPSInICsgZS5kb21haW4gKyAnIiB1cmk9IicgKyBlLnVyaSArICciJzsKKyAgICB0b3Au cG9zdE1lc3NhZ2UobXNnKTsKK30KKworZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigibWVzc2Fn ZSIsIHJlY3YsIGZhbHNlKTsKKzwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgpJbmRleDogTGF5 b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4tYWZmZWN0ZWQt YnktZG9jdW1lbnQtZG9tYWluLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Bvc3RNZXNzYWdlL2RvbWFpbi1hZmZlY3RlZC1ieS1kb2N1 bWVudC1kb21haW4tZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0 cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4tYWZmZWN0ZWQtYnktZG9jdW1lbnQt ZG9tYWluLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSw0IEBACit3aW5kb3cu bG9jYXRpb24uaHJlZiA9IGh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9zZWN1cml0eS9wb3N0TWVzc2Fn ZS9kb21haW4tYWZmZWN0ZWQtYnktZG9jdW1lbnQtZG9tYWluLmh0bWwKK2RvY3VtZW50LmRvbWFp biA9IDAuMC4xCisKK1JlY2VpdmVkIG1lc3NhZ2U6IGRhdGE9Ik1lc3NhZ2UgZnJvbSBwYXJlbnQi IGRvbWFpbj0iMC4wLjEiIHVyaT0iaHR0cDovLzEyNy4wLjAuMTo4MDAwL3NlY3VyaXR5L3Bvc3RN ZXNzYWdlL2RvbWFpbi1hZmZlY3RlZC1ieS1kb2N1bWVudC1kb21haW4uaHRtbCIKSW5kZXg6IExh eW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvZG9tYWluLWFuZC11cmkt dW5hZmZlY3RlZC1ieS1iYXNlLXRhZy1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0 VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4tYW5kLXVyaS11bmFm ZmVjdGVkLWJ5LWJhc2UtdGFnLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRl c3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvZG9tYWluLWFuZC11cmktdW5hZmZl Y3RlZC1ieS1iYXNlLXRhZy1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMyBA QAord2luZG93LmxvY2F0aW9uLmhyZWYgPSBodHRwOi8vMTI3LjAuMC4xOjgwMDAvc2VjdXJpdHkv cG9zdE1lc3NhZ2UvZG9tYWluLWFuZC11cmktdW5hZmZlY3RlZC1ieS1iYXNlLXRhZy5odG1sCisK K1JlY2VpdmVkIG1lc3NhZ2U6IGRhdGE9Ik1lc3NhZ2UgZnJvbSBwYXJlbnQiIGRvbWFpbj0iMTI3 LjAuMC4xIiB1cmk9Imh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9zZWN1cml0eS9wb3N0TWVzc2FnZS9k b21haW4tYW5kLXVyaS11bmFmZmVjdGVkLWJ5LWJhc2UtdGFnLmh0bWwiCg== 18404 2008-01-11 20:05:43 -0800 2008-01-12 00:50:06 -0800 Updated patch with more tests and updated document.domain behavior post-message.collinj2.patch text/plain 9673 collinj SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAyOTQyNikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjMgQEAKKzIwMDgtMDEtMTEgIENvbGxpbiBKYWNrc29uICA8d2Via2l0QGNvbGxp bmphY2tzb24uY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIFBhcnRpYWwgZml4IGZvciBodHRwOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0xNjc3NQorCisgICAgICAgIFdlIG5vdyB1c2UgZnJhbWUoKS0+bG9hZGVyKCktPnVybCgp IGZvciBwb3N0TWVzc2FnZSwgcHJldmVudGluZyBhCisgICAgICAgIG1hbGljaW91cyBzZW5kZXIg ZnJvbSBvdmVyd3JpdGluZyB0aGUgdXJpIHByb3BlcnR5ICh1c2luZyBhIDxiYXNlPiB0YWcsCisg ICAgICAgIGZvciBleGFtcGxlKS4gQWxzbywgdXNlIGZyYW1lLT5sb2FkZXIoKS0+dXJsKCkuaG9z dCgpIGluc3RlYWQgb2YgCisgICAgICAgIGluc3RlYWQgb2YgZG9jdW1lbnQoKS0+U2VjdXJpdHlP cmlnaW4oKS0+ZG9tYWluKCkgdG8gcmVmbGVjdCBhIHJlY2VudAorICAgICAgICBjbGFyaWZpY2F0 aW9uIGluIHRoZSBIVE1MNSBzcGVjLiAKKworICAgICAgICBUZXN0czogaHR0cC90ZXN0cy9zZWN1 cml0eS9wb3N0TWVzc2FnZS9kb21haW4tYWZmZWN0ZWQtYnktZG9jdW1lbnQtZG9tYWluLmh0bWwK KyAgICAgICAgICAgICAgIGh0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvZG9tYWluLWFu ZC11cmktdW5hZmZlY3RlZC1ieS1iYXNlLXRhZy5odG1sCisgICAgICAgICAgICAgICBodHRwL3Rl c3RzL3NlY3VyaXR5L3Bvc3RNZXNzYWdlL2phdmFzY3JpcHQtcGFnZS1zdGlsbC1zZW5kcy1kb21h aW4uaHRtbAorCisgICAgICAgICogYmluZGluZ3MvanMvSlNET01XaW5kb3dDdXN0b20uY3BwOgor ICAgICAgICAoV2ViQ29yZTo6SlNET01XaW5kb3c6OnBvc3RNZXNzYWdlKToKKworCiAyMDA4LTAx LTExICBTeWx2YWluIFBhc2NoZSAgPHN5bHZhaW4ucGFzY2hlQGdtYWlsLmNvbT4KIAogICAgICAg ICBSZXZpZXdlZCBieSBBbHAgVG9rZXIuCkluZGV4OiBXZWJDb3JlL2JpbmRpbmdzL2pzL0pTRE9N V2luZG93Q3VzdG9tLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL2JpbmRpbmdzL2pzL0pTRE9N V2luZG93Q3VzdG9tLmNwcAkocmV2aXNpb24gMjk0MjYpCisrKyBXZWJDb3JlL2JpbmRpbmdzL2pz L0pTRE9NV2luZG93Q3VzdG9tLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjMsNiArMjMsOCBAQAog I2luY2x1ZGUgIkRvY3VtZW50LmgiCiAjaW5jbHVkZSAiRE9NV2luZG93LmgiCiAjaW5jbHVkZSAi RXhjZXB0aW9uQ29kZS5oIgorI2luY2x1ZGUgIkZyYW1lLmgiCisjaW5jbHVkZSAiRnJhbWVMb2Fk ZXIuaCIKICNpbmNsdWRlICJranNfd2luZG93LmgiCiAjaW5jbHVkZSAia2pzL29iamVjdC5oIgog I2luY2x1ZGUgImtqcy92YWx1ZS5oIgpAQCAtMTE4LDggKzEyMCw4IEBAIEtKUzo6SlNWYWx1ZSog SlNET01XaW5kb3c6OnBvc3RNZXNzYWdlKEsKICAgICBET01XaW5kb3cqIHdpbmRvdyA9IGltcGwo KTsKICAgICAKICAgICBET01XaW5kb3cqIHNvdXJjZSA9IHN0YXRpY19jYXN0PEpTRE9NV2luZG93 Kj4oZXhlYy0+ZHluYW1pY0dsb2JhbE9iamVjdCgpKS0+aW1wbCgpOwotICAgIFN0cmluZyBkb21h aW4gPSBzb3VyY2UtPmRvY3VtZW50KCktPnNlY3VyaXR5T3JpZ2luKCktPmhvc3QoKTsKLSAgICBT dHJpbmcgdXJpID0gc291cmNlLT5kb2N1bWVudCgpLT5kb2N1bWVudFVSSSgpOworICAgIFN0cmlu ZyBkb21haW4gPSBzb3VyY2UtPmZyYW1lKCktPmxvYWRlcigpLT51cmwoKS5ob3N0KCk7CisgICAg U3RyaW5nIHVyaSA9IHNvdXJjZS0+ZnJhbWUoKS0+bG9hZGVyKCktPnVybCgpLnN0cmluZygpOwog ICAgIFN0cmluZyBtZXNzYWdlID0gYXJnc1swXS0+dG9TdHJpbmcoZXhlYyk7CiAgICAgCiAgICAg aWYgKGV4ZWMtPmhhZEV4Y2VwdGlvbigpKQpJbmRleDogTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9z ZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4tYW5kLXVyaS11bmFmZmVjdGVkLWJ5LWJhc2UtdGFn LWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3Vy aXR5L3Bvc3RNZXNzYWdlL2RvbWFpbi1hbmQtdXJpLXVuYWZmZWN0ZWQtYnktYmFzZS10YWctZXhw ZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0 eS9wb3N0TWVzc2FnZS9kb21haW4tYW5kLXVyaS11bmFmZmVjdGVkLWJ5LWJhc2UtdGFnLWV4cGVj dGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwzIEBACit3aW5kb3cubG9jYXRpb24uaHJl ZiA9IGh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9zZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4tYW5k LXVyaS11bmFmZmVjdGVkLWJ5LWJhc2UtdGFnLmh0bWwKKworUmVjZWl2ZWQgbWVzc2FnZTogZGF0 YT0iTWVzc2FnZSBmcm9tIHBhcmVudCIgZG9tYWluPSIxMjcuMC4wLjEiIHVyaT0iaHR0cDovLzEy Ny4wLjAuMTo4MDAwL3NlY3VyaXR5L3Bvc3RNZXNzYWdlL2RvbWFpbi1hbmQtdXJpLXVuYWZmZWN0 ZWQtYnktYmFzZS10YWcuaHRtbCIKSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJp dHkvcG9zdE1lc3NhZ2UvZG9tYWluLWFuZC11cmktdW5hZmZlY3RlZC1ieS1iYXNlLXRhZy5odG1s Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3Nh Z2UvZG9tYWluLWFuZC11cmktdW5hZmZlY3RlZC1ieS1iYXNlLXRhZy5odG1sCShyZXZpc2lvbiAw KQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4t YW5kLXVyaS11bmFmZmVjdGVkLWJ5LWJhc2UtdGFnLmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAg KzEsMzQgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQ+CitpZiAo d2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKSB7CisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIu ZHVtcEFzVGV4dCgpOworICAgIGxheW91dFRlc3RDb250cm9sbGVyLndhaXRVbnRpbERvbmUoKTsK K30KKworZnVuY3Rpb24gcmVjdihlKSB7CisgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInJl c3VsdCIpLmZpcnN0Q2hpbGQuZGF0YSA9IGUuZGF0YTsKKworICAgIGlmICh3aW5kb3cubGF5b3V0 VGVzdENvbnRyb2xsZXIpCisgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVyLm5vdGlmeURvbmUo KTsKK30KKworZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsIHJlY3YsIGZhbHNl KTsKKworZnVuY3Rpb24gdGVzdCgpIHsKKyAgICB2YXIgaWZyYW1lID0gZG9jdW1lbnQuZ2V0RWxl bWVudEJ5SWQoJ2NoaWxkJyk7CisgICAgdmFyIHdpbiA9IGlmcmFtZS5jb250ZW50V2luZG93Owor ICAgIHdpbi5wb3N0TWVzc2FnZSgnTWVzc2FnZSBmcm9tIHBhcmVudCcpOworfQorPC9zY3JpcHQ+ Cis8YmFzZSBocmVmPSJodHRwOi8vd3d3LmV4YW1wbGUuY29tLyI+Cis8Ym9keT4KKzxkaXY+d2lu ZG93LmxvY2F0aW9uLmhyZWYgPSA8c2NyaXB0PmRvY3VtZW50LndyaXRlKHdpbmRvdy5sb2NhdGlv bi5ocmVmKTs8L3NjcmlwdD48L2Rpdj4KKzxkaXY+PGlmcmFtZSBzcmM9Imh0dHA6Ly9sb2NhbGhv c3Q6ODAwMC9zZWN1cml0eS9wb3N0TWVzc2FnZS9yZXNvdXJjZXMvcG9zdC1tZXNzYWdlLWxpc3Rl bmVyLmh0bWwiIG9ubG9hZD0idGVzdCgpIgorICBpZD0iY2hpbGQiIHdpZHRoPSI4MDAiIGhlaWdo dD0iMzAwIiBzdHlsZT0iYm9yZGVyOiAxcHggc29saWQgYmxhY2s7Ij4KKzwvaWZyYW1lPjwvZGl2 PgorPGRpdiBpZD0icmVzdWx0Ij53YWl0aW5nLi4uPC9kaXY+Cis8L2JvZHk+Cis8L2h0bWw+CisK SW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvZG9tYWlu LXVuYWZmZWN0ZWQtYnktZG9jdW1lbnQtZG9tYWluLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t LSBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Bvc3RNZXNzYWdlL2RvbWFpbi11bmFm ZmVjdGVkLWJ5LWRvY3VtZW50LWRvbWFpbi1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBM YXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Bvc3RNZXNzYWdlL2RvbWFpbi11bmFmZmVj dGVkLWJ5LWRvY3VtZW50LWRvbWFpbi1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAg KzEsNCBAQAord2luZG93LmxvY2F0aW9uLmhyZWYgPSBodHRwOi8vMTI3LjAuMC4xOjgwMDAvc2Vj dXJpdHkvcG9zdE1lc3NhZ2UvZG9tYWluLXVuYWZmZWN0ZWQtYnktZG9jdW1lbnQtZG9tYWluLmh0 bWwKK2RvY3VtZW50LmRvbWFpbiA9IDAuMC4xCisKK1JlY2VpdmVkIG1lc3NhZ2U6IGRhdGE9Ik1l c3NhZ2UgZnJvbSBwYXJlbnQiIGRvbWFpbj0iMTI3LjAuMC4xIiB1cmk9Imh0dHA6Ly8xMjcuMC4w LjE6ODAwMC9zZWN1cml0eS9wb3N0TWVzc2FnZS9kb21haW4tdW5hZmZlY3RlZC1ieS1kb2N1bWVu dC1kb21haW4uaHRtbCIKSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9z dE1lc3NhZ2UvZG9tYWluLXVuYWZmZWN0ZWQtYnktZG9jdW1lbnQtZG9tYWluLmh0bWwKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9kb21h aW4tdW5hZmZlY3RlZC1ieS1kb2N1bWVudC1kb21haW4uaHRtbAkocmV2aXNpb24gMCkKKysrIExh eW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvZG9tYWluLXVuYWZmZWN0 ZWQtYnktZG9jdW1lbnQtZG9tYWluLmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMzUgQEAK KzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQ+CitpZiAod2luZG93Lmxh eW91dFRlc3RDb250cm9sbGVyKSB7CisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4 dCgpOworICAgIGxheW91dFRlc3RDb250cm9sbGVyLndhaXRVbnRpbERvbmUoKTsKK30KKworZnVu Y3Rpb24gcmVjdihlKSB7CisgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInJlc3VsdCIpLmZp cnN0Q2hpbGQuZGF0YSA9IGUuZGF0YTsKKworICAgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRy b2xsZXIpCisgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVyLm5vdGlmeURvbmUoKTsKK30KKwor ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsIHJlY3YsIGZhbHNlKTsKKworZnVu Y3Rpb24gdGVzdCgpIHsKKyAgICB2YXIgaWZyYW1lID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQo J2NoaWxkJyk7CisgICAgdmFyIHdpbiA9IGlmcmFtZS5jb250ZW50V2luZG93OworICAgIHdpbi5w b3N0TWVzc2FnZSgnTWVzc2FnZSBmcm9tIHBhcmVudCcpOworfQorCitkb2N1bWVudC5kb21haW4g PSAiMC4wLjEiOworPC9zY3JpcHQ+Cis8Ym9keT4KKzxkaXY+d2luZG93LmxvY2F0aW9uLmhyZWYg PSA8c2NyaXB0PmRvY3VtZW50LndyaXRlKHdpbmRvdy5sb2NhdGlvbi5ocmVmKTs8L3NjcmlwdD48 L2Rpdj4KKzxkaXY+ZG9jdW1lbnQuZG9tYWluID0gPHNjcmlwdD5kb2N1bWVudC53cml0ZShkb2N1 bWVudC5kb21haW4pOzwvc2NyaXB0PjwvZGl2PgorPGRpdj48aWZyYW1lIHNyYz0iaHR0cDovL2xv Y2FsaG9zdDo4MDAwL3NlY3VyaXR5L3Bvc3RNZXNzYWdlL3Jlc291cmNlcy9wb3N0LW1lc3NhZ2Ut bGlzdGVuZXIuaHRtbCIgaWQ9ImNoaWxkIiB3aWR0aD0iODAwIiBoZWlnaHQ9IjMwMCIKKyAgc3R5 bGU9ImJvcmRlcjogMXB4IHNvbGlkIGJsYWNrOyIgb25sb2FkPSJ0ZXN0KCkiPgorPC9pZnJhbWU+ PC9kaXY+Cis8ZGl2IGlkPSJyZXN1bHQiPndhaXRpbmcuLi48L2Rpdj4KKzwvYm9keT4KKzwvaHRt bD4KSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvamF2 YXNjcmlwdC1wYWdlLXN0aWxsLXNlbmRzLWRvbWFpbi1leHBlY3RlZC50eHQKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9qYXZhc2NyaXB0 LXBhZ2Utc3RpbGwtc2VuZHMtZG9tYWluLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExh eW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvamF2YXNjcmlwdC1wYWdl LXN0aWxsLXNlbmRzLWRvbWFpbi1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEs MyBAQAord2luZG93LmxvY2F0aW9uLmhyZWYgPSBodHRwOi8vMTI3LjAuMC4xOjgwMDAvc2VjdXJp dHkvcG9zdE1lc3NhZ2UvamF2YXNjcmlwdC1wYWdlLXN0aWxsLXNlbmRzLWRvbWFpbi5odG1sCisK K1JlY2VpdmVkIG1lc3NhZ2U6IGRhdGE9IkhlbGxvIGZyb20gY2hpbGQiIGRvbWFpbj0ibG9jYWxo b3N0IiB1cmk9Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9zZWN1cml0eS9wb3N0TWVzc2FnZS9yZXNv dXJjZXMvamF2YXNjcmlwdC1wb3N0LW1lc3NhZ2Utc2VuZGVyLmh0bWwiCkluZGV4OiBMYXlvdXRU ZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Bvc3RNZXNzYWdlL2phdmFzY3JpcHQtcGFnZS1zdGls bC1zZW5kcy1kb21haW4uaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9odHRwL3Rlc3Rz L3NlY3VyaXR5L3Bvc3RNZXNzYWdlL2phdmFzY3JpcHQtcGFnZS1zdGlsbC1zZW5kcy1kb21haW4u aHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9z dE1lc3NhZ2UvamF2YXNjcmlwdC1wYWdlLXN0aWxsLXNlbmRzLWRvbWFpbi5odG1sCShyZXZpc2lv biAwKQpAQCAtMCwwICsxLDMxIEBACis8IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorPGhlYWQ+Cis8 c2NyaXB0PgoraWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikgeworICAgIGxheW91dFRl c3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci53YWl0 VW50aWxEb25lKCk7Cit9CisKK2Z1bmN0aW9uIHJlY3YoZSkgeworICAgIHZhciBtc2cgPSAnUmVj ZWl2ZWQgbWVzc2FnZTogZGF0YT0iJyArIGUuZGF0YSArICciIGRvbWFpbj0iJyArIGUuZG9tYWlu ICsgJyIgdXJpPSInICsgZS51cmkgKyAnIic7CisKKyAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJ ZCgicmVzdWx0IikuZmlyc3RDaGlsZC5kYXRhID0gbXNnOworCisgICAgaWYgKHdpbmRvdy5sYXlv dXRUZXN0Q29udHJvbGxlcikKKyAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIubm90aWZ5RG9u ZSgpOworfQorCitkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIiwgcmVjdiwgZmFs c2UpOworCis8L3NjcmlwdD4KKzxiYXNlIGhyZWY9Imh0dHA6Ly93d3cuZXhhbXBsZS5jb20vIj4K Kzxib2R5PgorPGRpdj53aW5kb3cubG9jYXRpb24uaHJlZiA9IDxzY3JpcHQ+ZG9jdW1lbnQud3Jp dGUoZG9jdW1lbnQubG9jYXRpb24uaHJlZik7PC9zY3JpcHQ+PC9kaXY+Cis8ZGl2PjxpZnJhbWUg c3JjPSJodHRwOi8vbG9jYWxob3N0OjgwMDAvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvcmVzb3VyY2Vz L2phdmFzY3JpcHQtcG9zdC1tZXNzYWdlLXNlbmRlci5odG1sIgorICBpZD0iY2hpbGQiIHdpZHRo PSI4MDAiIGhlaWdodD0iMzAwIiBzdHlsZT0iYm9yZGVyOiAxcHggc29saWQgYmxhY2s7Ij4KKzwv aWZyYW1lPjwvZGl2PgorPGRpdiBpZD0icmVzdWx0Ij53YWl0aW5nLi4uPC9kaXY+Cis8L2JvZHk+ Cis8L2h0bWw+CisKSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1l c3NhZ2UvcmVzb3VyY2VzL2phdmFzY3JpcHQtcG9zdC1tZXNzYWdlLXNlbmRlci5odG1sCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvcmVz b3VyY2VzL2phdmFzY3JpcHQtcG9zdC1tZXNzYWdlLXNlbmRlci5odG1sCShyZXZpc2lvbiAwKQor KysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2FnZS9yZXNvdXJjZXMv amF2YXNjcmlwdC1wb3N0LW1lc3NhZ2Utc2VuZGVyLmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAg KzEsMTYgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8Ym9keSBvbmxvYWQ9Im5hdigpIj4K KzxzY3JpcHQ+CitmdW5jdGlvbiBuYXYoKSB7CisgICAgdmFyIHVybCA9ICJqYXZhc2NyaXB0Oic8 c2NyaXB0PiIgKyAKKyAgICAgICJ0b3AucG9zdE1lc3NhZ2UoXCJIZWxsbyBmcm9tIGNoaWxkXCIp OyIgKyAKKyAgICAgICJkb2N1bWVudC53cml0ZShcIk1lc3NhZ2Ugc2VudFwiKTsiICsKKyAgICAg ICI8L3NjcmkiICsgInB0PiciOworCisgICAgd2luZG93LmxvY2F0aW9uLmhyZWYgPSB1cmw7Cit9 Cis8L3NjcmlwdD4KK1NlbmRpbmcuLi4KKzwvYm9keT4KKzwvaHRtbD4KSW5kZXg6IExheW91dFRl c3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcG9zdE1lc3NhZ2UvcmVzb3VyY2VzL3Bvc3QtbWVzc2Fn ZS1saXN0ZW5lci5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2Vj dXJpdHkvcG9zdE1lc3NhZ2UvcmVzb3VyY2VzL3Bvc3QtbWVzc2FnZS1saXN0ZW5lci5odG1sCShy ZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9wb3N0TWVzc2Fn ZS9yZXNvdXJjZXMvcG9zdC1tZXNzYWdlLWxpc3RlbmVyLmh0bWwJKHJldmlzaW9uIDApCkBAIC0w LDAgKzEsMTQgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8Ym9keT4KKzxkaXY+d2luZG93 LmxvY2F0aW9uLmhyZWYgPSA8c2NyaXB0PmRvY3VtZW50LndyaXRlKHdpbmRvdy5sb2NhdGlvbi5o cmVmKTs8L3NjcmlwdD48L2Rpdj4KKzxzY3JpcHQ+CitmdW5jdGlvbiByZWN2KGUpIHsKKyAgICB2 YXIgbXNnID0gJ1JlY2VpdmVkIG1lc3NhZ2U6IGRhdGE9IicgKyBlLmRhdGEgKyAnIiBkb21haW49 IicgKyBlLmRvbWFpbiArICciIHVyaT0iJyArIGUudXJpICsgJyInOworICAgIHRvcC5wb3N0TWVz c2FnZShtc2cpOworfQorCitkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIiwgcmVj diwgZmFsc2UpOworPC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+Cg==