167920 2017-02-06 19:55:13 -0800 Symbols exposed on cross-origin Window / Location objects should be configurable 2017-02-06 20:48:51 -0800 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED WebExposed P2 Normal --- 1 cdumez cdumez achristensen cdumez commit-queue ggaren mark.lam rniwa sam oldest_to_newest 1273822 0 cdumez 2017-02-06 19:55:13 -0800 Symbols exposed on cross-origin Window / Location objects should be configurable: - https://html.spec.whatwg.org/#crossorigingetownpropertyhelper-(-o,-p-) (Step 1) Firefox behaves as per specification. 1273823 1 300779 cdumez 2017-02-06 19:57:51 -0800 Created attachment 300779 Patch 1273825 2 cdumez 2017-02-06 20:03:08 -0800 With this bug and Bug 167917 fixed, 100% pass rate on: - http://w3c-test.org/html/browsers/origin/cross-origin-objects/cross-origin-objects.html 1273830 3 300779 rniwa 2017-02-06 20:12:35 -0800 Comment on attachment 300779 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=300779&action=review > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:100 > if (propertyName == exec->propertyNames().toStringTagSymbol || propertyName == exec->propertyNames().hasInstanceSymbol || propertyName == exec->propertyNames().isConcatSpreadableSymbol) { Are these only symbols that could ever exist on the window object? It seems a bit fragile to have a hard-coded list here. 1273839 4 cdumez 2017-02-06 20:27:53 -0800 (In reply to comment #3) > Comment on attachment 300779 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=300779&action=review > > > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:100 > > if (propertyName == exec->propertyNames().toStringTagSymbol || propertyName == exec->propertyNames().hasInstanceSymbol || propertyName == exec->propertyNames().isConcatSpreadableSymbol) { > > Are these only symbols that could ever exist on the window object? > It seems a bit fragile to have a hard-coded list here. These are the only ones that we expose on Window / Location objects that are *cross-origin*. They are listed in the spec here: https://html.spec.whatwg.org/#crossorigingetownpropertyhelper-(-o,-p-) (Step 1). 1273843 5 cdumez 2017-02-06 20:31:06 -0800 (In reply to comment #4) > (In reply to comment #3) > > Comment on attachment 300779 [details] > > Patch > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=300779&action=review > > > > > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:100 > > > if (propertyName == exec->propertyNames().toStringTagSymbol || propertyName == exec->propertyNames().hasInstanceSymbol || propertyName == exec->propertyNames().isConcatSpreadableSymbol) { > > > > Are these only symbols that could ever exist on the window object? > > It seems a bit fragile to have a hard-coded list here. > > These are the only ones that we expose on Window / Location objects that are > *cross-origin*. They are listed in the spec here: > https://html.spec.whatwg.org/#crossorigingetownpropertyhelper-(-o,-p-) (Step > 1). This is how the HTML specification and our code operates for cross-origin Window / Location objects, we explicitly whitelist things we want to expose. The list of properties exposed cross-origin on these objects is also hard-coded. 1273845 6 300779 rniwa 2017-02-06 20:33:19 -0800 Comment on attachment 300779 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=300779&action=review >>>> Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:100 >>>> if (propertyName == exec->propertyNames().toStringTagSymbol || propertyName == exec->propertyNames().hasInstanceSymbol || propertyName == exec->propertyNames().isConcatSpreadableSymbol) { >>> >>> Are these only symbols that could ever exist on the window object? >>> It seems a bit fragile to have a hard-coded list here. >> >> These are the only ones that we expose on Window / Location objects that are *cross-origin*. They are listed in the spec here: >> https://html.spec.whatwg.org/#crossorigingetownpropertyhelper-(-o,-p-) (Step 1). > > This is how the HTML specification and our code operates for cross-origin Window / Location objects, we explicitly whitelist things we want to expose. The list of properties exposed cross-origin on these objects is also hard-coded. We should probably add that URL as a comment. > Source/WebCore/bindings/js/JSLocationCustom.cpp:-57 > if (propertyName == state->propertyNames().toStringTagSymbol || propertyName == state->propertyNames().hasInstanceSymbol || propertyName == state->propertyNames().isConcatSpreadableSymbol) { > - slot.setUndefined(); Ditto here. Also, perhaps we should extract this check into a helper function so that there's a single list instead of being duplicated in two places. 1273846 7 300785 cdumez 2017-02-06 20:46:55 -0800 Created attachment 300785 Patch 1273847 8 300785 cdumez 2017-02-06 20:48:45 -0800 Comment on attachment 300785 Patch Clearing flags on attachment: 300785 Committed r211772: <http://trac.webkit.org/changeset/211772> 1273848 9 cdumez 2017-02-06 20:48:51 -0800 All reviewed patches have been landed. Closing bug. 300779 2017-02-06 19:57:51 -0800 2017-02-06 20:46:51 -0800 Patch bug-167920-20170206195529.patch text/plain 5375 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjExNzY4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTJkODQ0OTIxODY5YjQ0 NDY3Mjg3NTc1MmYzMmNjMjc4MDczMzBjMC4uMDA2MGE1MzMxZGY4OGI5YzllMmIyMjc0N2VhOWM3 Y2MwMGE3OGFmNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSw1ICsxLDI0IEBACiAyMDE3LTAyLTA2ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKKyAgICAgICAgU3ltYm9scyBleHBvc2VkIG9u IGNyb3NzLW9yaWdpbiBXaW5kb3cgLyBMb2NhdGlvbiBvYmplY3RzIHNob3VsZCBiZSBjb25maWd1 cmFibGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2 NzkyMAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFN5 bWJvbHMgZXhwb3NlZCBvbiBjcm9zcy1vcmlnaW4gV2luZG93IC8gTG9jYXRpb24gb2JqZWN0cyBz aG91bGQgYmUgY29uZmlndXJhYmxlOgorICAgICAgICAtIGh0dHBzOi8vaHRtbC5zcGVjLndoYXR3 Zy5vcmcvI2Nyb3Nzb3JpZ2luZ2V0b3ducHJvcGVydHloZWxwZXItKC1vLC1wLSkgKFN0ZXAgMSkK KworICAgICAgICBGaXJlZm94IGJlaGF2ZXMgYXMgcGVyIHNwZWNpZmljYXRpb24uCisKKyAgICAg ICAgTm8gbmV3IHRlc3RzLCByZWJhc2VsaW5lZCBleGlzdGluZyB0ZXN0LgorCisgICAgICAgICog YmluZGluZ3MvanMvSlNET01XaW5kb3dDdXN0b20uY3BwOgorICAgICAgICAoV2ViQ29yZTo6anNE T01XaW5kb3dHZXRPd25Qcm9wZXJ0eVNsb3RSZXN0cmljdGVkQWNjZXNzKToKKyAgICAgICAgKiBi aW5kaW5ncy9qcy9KU0xvY2F0aW9uQ3VzdG9tLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkpTTG9j YXRpb246OmdldE93blByb3BlcnR5U2xvdERlbGVnYXRlKToKKworMjAxNy0wMi0wNiAgQ2hyaXMg RHVtZXogIDxjZHVtZXpAYXBwbGUuY29tPgorCiAgICAgICAgIE9iamVjdC5wcmV2ZW50RXh0ZW5z aW9ucygpIG9uIGEgTG9jYXRpb24gb2JqZWN0IHNob3VsZCB0aHJvdyBhIFR5cGVFcnJvcgogICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTY3OTE3CiAKZGlm ZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTRE9NV2luZG93Q3VzdG9tLmNw cCBiL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTRE9NV2luZG93Q3VzdG9tLmNwcAppbmRl eCA0OWFlNTk3M2JmM2M5YmRmYTkzZDNhMDc4MjI1NjQxZTRiMGEzN2YzLi43MDRiMWY1YWRkNWQ0 N2ViMzgyNmY5YmIyOTVkZTc0ZWViYjJmMzY3IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9i aW5kaW5ncy9qcy9KU0RPTVdpbmRvd0N1c3RvbS5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvYmlu ZGluZ3MvanMvSlNET01XaW5kb3dDdXN0b20uY3BwCkBAIC05OCw3ICs5OCw3IEBAIHN0YXRpYyBi b29sIGpzRE9NV2luZG93R2V0T3duUHJvcGVydHlTbG90UmVzdHJpY3RlZEFjY2VzcyhKU0RPTVdp bmRvdyogdGhpc09iamVjCiAgICAgfQogCiAgICAgaWYgKHByb3BlcnR5TmFtZSA9PSBleGVjLT5w cm9wZXJ0eU5hbWVzKCkudG9TdHJpbmdUYWdTeW1ib2wgfHwgcHJvcGVydHlOYW1lID09IGV4ZWMt PnByb3BlcnR5TmFtZXMoKS5oYXNJbnN0YW5jZVN5bWJvbCB8fCBwcm9wZXJ0eU5hbWUgPT0gZXhl Yy0+cHJvcGVydHlOYW1lcygpLmlzQ29uY2F0U3ByZWFkYWJsZVN5bWJvbCkgewotICAgICAgICBz bG90LnNldFVuZGVmaW5lZCgpOworICAgICAgICBzbG90LnNldFZhbHVlKHRoaXNPYmplY3QsIFJl YWRPbmx5IHwgRG9udEVudW0sIGpzVW5kZWZpbmVkKCkpOwogICAgICAgICByZXR1cm4gdHJ1ZTsK ICAgICB9CiAKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTTG9jYXRp b25DdXN0b20uY3BwIGIvU291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNMb2NhdGlvbkN1c3Rv bS5jcHAKaW5kZXggZTNlOTBlZTgzNGU0MzQzZWEwYjc4ZjllYmIzYTUxZjdlMTU4NmJhZi4uOTUy N2NjYTJhOGI0YjE4MmMyNGFlY2ZjZGQ3YWI1MGU3OWY5YTY4YSAxMDA2NDQKLS0tIGEvU291cmNl L1dlYkNvcmUvYmluZGluZ3MvanMvSlNMb2NhdGlvbkN1c3RvbS5jcHAKKysrIGIvU291cmNlL1dl YkNvcmUvYmluZGluZ3MvanMvSlNMb2NhdGlvbkN1c3RvbS5jcHAKQEAgLTU0LDcgKzU0LDcgQEAg Ym9vbCBKU0xvY2F0aW9uOjpnZXRPd25Qcm9wZXJ0eVNsb3REZWxlZ2F0ZShFeGVjU3RhdGUqIHN0 YXRlLCBQcm9wZXJ0eU5hbWUgcHJvcGUKICAgICAgICAgcmV0dXJuIGZhbHNlOwogCiAgICAgaWYg KHByb3BlcnR5TmFtZSA9PSBzdGF0ZS0+cHJvcGVydHlOYW1lcygpLnRvU3RyaW5nVGFnU3ltYm9s IHx8IHByb3BlcnR5TmFtZSA9PSBzdGF0ZS0+cHJvcGVydHlOYW1lcygpLmhhc0luc3RhbmNlU3lt Ym9sIHx8IHByb3BlcnR5TmFtZSA9PSBzdGF0ZS0+cHJvcGVydHlOYW1lcygpLmlzQ29uY2F0U3By ZWFkYWJsZVN5bWJvbCkgewotICAgICAgICBzbG90LnNldFVuZGVmaW5lZCgpOworICAgICAgICBz bG90LnNldFZhbHVlKHRoaXMsIFJlYWRPbmx5IHwgRG9udEVudW0sIGpzVW5kZWZpbmVkKCkpOwog ICAgICAgICByZXR1cm4gdHJ1ZTsKICAgICB9CiAKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2lt cG9ydGVkL3czYy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9pbXBvcnRlZC93M2MvQ2hhbmdlTG9n CmluZGV4IDQyNmYyY2EyYzFkYTAwYmZmMzE5Yzk2YjJmYzk0ZGYwMDdiY2MyMDUuLmJkYmQ5Mjcy MjcxZmU5N2Y5NTdmZTYyY2ExYzFjY2MyMzc0OGE0YmIgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3Rz L2ltcG9ydGVkL3czYy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvaW1wb3J0ZWQvdzNjL0No YW5nZUxvZwpAQCAtMSw1ICsxLDE2IEBACiAyMDE3LTAyLTA2ICBDaHJpcyBEdW1leiAgPGNkdW1l ekBhcHBsZS5jb20+CiAKKyAgICAgICAgU3ltYm9scyBleHBvc2VkIG9uIGNyb3NzLW9yaWdpbiBX aW5kb3cgLyBMb2NhdGlvbiBvYmplY3RzIHNob3VsZCBiZSBjb25maWd1cmFibGUKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2NzkyMAorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFJlYmFzZWxpbmUgd2ViIHBs YXRmb3JtIHRlc3Qgbm93IHRoYXQgbW9yZSBjaGVja3MgYXJlIHBhc3NpbmcuCisKKyAgICAgICAg KiB3ZWItcGxhdGZvcm0tdGVzdHMvaHRtbC9icm93c2Vycy9vcmlnaW4vY3Jvc3Mtb3JpZ2luLW9i amVjdHMvY3Jvc3Mtb3JpZ2luLW9iamVjdHMtZXhwZWN0ZWQudHh0OgorCisyMDE3LTAyLTA2ICBD aHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKICAgICAgICAgT2JqZWN0LnByZXZlbnRF eHRlbnNpb25zKCkgb24gYSBMb2NhdGlvbiBvYmplY3Qgc2hvdWxkIHRocm93IGEgVHlwZUVycm9y CiAgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjc5MTcK IApkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvaW1wb3J0ZWQvdzNjL3dlYi1wbGF0Zm9ybS10ZXN0 cy9odG1sL2Jyb3dzZXJzL29yaWdpbi9jcm9zcy1vcmlnaW4tb2JqZWN0cy9jcm9zcy1vcmlnaW4t b2JqZWN0cy1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9pbXBvcnRlZC93M2Mvd2ViLXBsYXRm b3JtLXRlc3RzL2h0bWwvYnJvd3NlcnMvb3JpZ2luL2Nyb3NzLW9yaWdpbi1vYmplY3RzL2Nyb3Nz LW9yaWdpbi1vYmplY3RzLWV4cGVjdGVkLnR4dAppbmRleCA0YmMyYWJlOTVmYjEzMWQ0YmYxZjVh ZGQ0MzU0NTM2YWNhZTYyNTk3Li5iZTU5NTc2OTlhZGU4NTc1NTA2NWJiNTI3MzFmNTc5OTFkZGE4 YTk2IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9pbXBvcnRlZC93M2Mvd2ViLXBsYXRmb3JtLXRl c3RzL2h0bWwvYnJvd3NlcnMvb3JpZ2luL2Nyb3NzLW9yaWdpbi1vYmplY3RzL2Nyb3NzLW9yaWdp bi1vYmplY3RzLWV4cGVjdGVkLnR4dAorKysgYi9MYXlvdXRUZXN0cy9pbXBvcnRlZC93M2Mvd2Vi LXBsYXRmb3JtLXRlc3RzL2h0bWwvYnJvd3NlcnMvb3JpZ2luL2Nyb3NzLW9yaWdpbi1vYmplY3Rz L2Nyb3NzLW9yaWdpbi1vYmplY3RzLWV4cGVjdGVkLnR4dApAQCAtMTUsOCArMTUsOCBAQCBQQVNT IFtbUHJldmVudEV4dGVuc2lvbnNdXSBzaG91bGQgdGhyb3cgZm9yIGNyb3NzLW9yaWdpbiBvYmpl Y3RzCiBQQVNTIFtbUHJldmVudEV4dGVuc2lvbnNdXSBzaG91bGQgdGhyb3cgZm9yIGNyb3NzLW9y aWdpbiBvYmplY3RzIChleGNlcHRpb24gdHlwZSkgCiBQQVNTIFtbR2V0T3duUHJvcGVydHldXSAt IFByb3BlcnRpZXMgb24gY3Jvc3Mtb3JpZ2luIG9iamVjdHMgc2hvdWxkIGJlIHJlcG9ydGVkIHxv d258IAogUEFTUyBbW0dldE93blByb3BlcnR5XV0gLSBQcm9wZXJ0aWVzIG9uIGNyb3NzLW9yaWdp biBvYmplY3RzIHNob3VsZCBiZSByZXBvcnRlZCB8b3dufCAoZXhjZXB0aW9uIHR5cGUpIAotRkFJ TCBbW0dldE93blByb3BlcnR5XV0gLSBQcm9wZXJ0eSBkZXNjcmlwdG9ycyBmb3IgY3Jvc3Mtb3Jp Z2luIHByb3BlcnRpZXMgc2hvdWxkIGJlIHNldCB1cCBjb3JyZWN0bHkgYXNzZXJ0X2VxdWFsczog cHJvcGVydHkgZGVzY3JpcHRvciBmb3IgU3ltYm9sKFN5bWJvbC50b1N0cmluZ1RhZykgc2hvdWxk IGJlIGNvbmZpZ3VyYWJsZSBleHBlY3RlZCB0cnVlIGJ1dCBnb3QgZmFsc2UKLUZBSUwgW1tHZXRP d25Qcm9wZXJ0eV1dIC0gUHJvcGVydHkgZGVzY3JpcHRvcnMgZm9yIGNyb3NzLW9yaWdpbiBwcm9w ZXJ0aWVzIHNob3VsZCBiZSBzZXQgdXAgY29ycmVjdGx5IChleGNlcHRpb24gdHlwZSkgYXNzZXJ0 X3VucmVhY2hlZDogTWFpbiB0ZXN0IGZhaWxlZCBSZWFjaGVkIHVucmVhY2hhYmxlIGNvZGUKK1BB U1MgW1tHZXRPd25Qcm9wZXJ0eV1dIC0gUHJvcGVydHkgZGVzY3JpcHRvcnMgZm9yIGNyb3NzLW9y aWdpbiBwcm9wZXJ0aWVzIHNob3VsZCBiZSBzZXQgdXAgY29ycmVjdGx5IAorUEFTUyBbW0dldE93 blByb3BlcnR5XV0gLSBQcm9wZXJ0eSBkZXNjcmlwdG9ycyBmb3IgY3Jvc3Mtb3JpZ2luIHByb3Bl cnRpZXMgc2hvdWxkIGJlIHNldCB1cCBjb3JyZWN0bHkgKGV4Y2VwdGlvbiB0eXBlKSAKIFBBU1Mg W1tEZWxldGVdXSBTaG91bGQgdGhyb3cgb24gY3Jvc3Mtb3JpZ2luIG9iamVjdHMgCiBQQVNTIFtb RGVsZXRlXV0gU2hvdWxkIHRocm93IG9uIGNyb3NzLW9yaWdpbiBvYmplY3RzIChleGNlcHRpb24g dHlwZSkgCiBQQVNTIFtbRGVmaW5lT3duUHJvcGVydHldXSBTaG91bGQgdGhyb3cgZm9yIGNyb3Nz LW9yaWdpbiBvYmplY3RzIAo= 300785 2017-02-06 20:46:55 -0800 2017-02-06 20:48:45 -0800 Patch bug-167920-20170206204434.patch text/plain 5628 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjExNzY4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTJkODQ0OTIxODY5YjQ0 NDY3Mjg3NTc1MmYzMmNjMjc4MDczMzBjMC4uM2UzMDE2Yjg5N2UxM2YyMWU3Nzc1ZmI1OTc2MjMz OGE4NDMyZDY4ZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSw1ICsxLDI0IEBACiAyMDE3LTAyLTA2ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKKyAgICAgICAgU3ltYm9scyBleHBvc2VkIG9u IGNyb3NzLW9yaWdpbiBXaW5kb3cgLyBMb2NhdGlvbiBvYmplY3RzIHNob3VsZCBiZSBjb25maWd1 cmFibGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2 NzkyMAorCisgICAgICAgIFJldmlld2VkIGJ5IFJ5b3N1a2UgTml3YS4KKworICAgICAgICBTeW1i b2xzIGV4cG9zZWQgb24gY3Jvc3Mtb3JpZ2luIFdpbmRvdyAvIExvY2F0aW9uIG9iamVjdHMgc2hv dWxkIGJlIGNvbmZpZ3VyYWJsZToKKyAgICAgICAgLSBodHRwczovL2h0bWwuc3BlYy53aGF0d2cu b3JnLyNjcm9zc29yaWdpbmdldG93bnByb3BlcnR5aGVscGVyLSgtbywtcC0pIChTdGVwIDEpCisK KyAgICAgICAgRmlyZWZveCBiZWhhdmVzIGFzIHBlciBzcGVjaWZpY2F0aW9uLgorCisgICAgICAg IE5vIG5ldyB0ZXN0cywgcmViYXNlbGluZWQgZXhpc3RpbmcgdGVzdC4KKworICAgICAgICAqIGJp bmRpbmdzL2pzL0pTRE9NV2luZG93Q3VzdG9tLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OmpzRE9N V2luZG93R2V0T3duUHJvcGVydHlTbG90UmVzdHJpY3RlZEFjY2Vzcyk6CisgICAgICAgICogYmlu ZGluZ3MvanMvSlNMb2NhdGlvbkN1c3RvbS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpKU0xvY2F0 aW9uOjpnZXRPd25Qcm9wZXJ0eVNsb3REZWxlZ2F0ZSk6CisKKzIwMTctMDItMDYgIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKwogICAgICAgICBPYmplY3QucHJldmVudEV4dGVuc2lv bnMoKSBvbiBhIExvY2F0aW9uIG9iamVjdCBzaG91bGQgdGhyb3cgYSBUeXBlRXJyb3IKICAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2NzkxNwogCmRpZmYg LS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0RPTVdpbmRvd0N1c3RvbS5jcHAg Yi9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0RPTVdpbmRvd0N1c3RvbS5jcHAKaW5kZXgg NDlhZTU5NzNiZjNjOWJkZmE5M2QzYTA3ODIyNTY0MWU0YjBhMzdmMy4uMDQxOWJiZmRjMTY4MGYx ODg0NzRhNzc1MTA1YTljNmU1YzM4ZmE3MSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYmlu ZGluZ3MvanMvSlNET01XaW5kb3dDdXN0b20uY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2JpbmRp bmdzL2pzL0pTRE9NV2luZG93Q3VzdG9tLmNwcApAQCAtOTcsOCArOTcsOSBAQCBzdGF0aWMgYm9v bCBqc0RPTVdpbmRvd0dldE93blByb3BlcnR5U2xvdFJlc3RyaWN0ZWRBY2Nlc3MoSlNET01XaW5k b3cqIHRoaXNPYmplYwogICAgICAgICByZXR1cm4gdHJ1ZTsKICAgICB9CiAKKyAgICAvLyBodHRw czovL2h0bWwuc3BlYy53aGF0d2cub3JnLyNjcm9zc29yaWdpbmdldG93bnByb3BlcnR5aGVscGVy LSgtbywtcC0pCiAgICAgaWYgKHByb3BlcnR5TmFtZSA9PSBleGVjLT5wcm9wZXJ0eU5hbWVzKCku dG9TdHJpbmdUYWdTeW1ib2wgfHwgcHJvcGVydHlOYW1lID09IGV4ZWMtPnByb3BlcnR5TmFtZXMo KS5oYXNJbnN0YW5jZVN5bWJvbCB8fCBwcm9wZXJ0eU5hbWUgPT0gZXhlYy0+cHJvcGVydHlOYW1l cygpLmlzQ29uY2F0U3ByZWFkYWJsZVN5bWJvbCkgewotICAgICAgICBzbG90LnNldFVuZGVmaW5l ZCgpOworICAgICAgICBzbG90LnNldFZhbHVlKHRoaXNPYmplY3QsIFJlYWRPbmx5IHwgRG9udEVu dW0sIGpzVW5kZWZpbmVkKCkpOwogICAgICAgICByZXR1cm4gdHJ1ZTsKICAgICB9CiAKZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTTG9jYXRpb25DdXN0b20uY3BwIGIv U291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNMb2NhdGlvbkN1c3RvbS5jcHAKaW5kZXggZTNl OTBlZTgzNGU0MzQzZWEwYjc4ZjllYmIzYTUxZjdlMTU4NmJhZi4uMjhmYWZiNGEwYzkzYTZiYjFm MzE3MzczNTg4NzdlYjliMzRlZTBkMSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYmluZGlu Z3MvanMvSlNMb2NhdGlvbkN1c3RvbS5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvYmluZGluZ3Mv anMvSlNMb2NhdGlvbkN1c3RvbS5jcHAKQEAgLTUzLDggKzUzLDkgQEAgYm9vbCBKU0xvY2F0aW9u OjpnZXRPd25Qcm9wZXJ0eVNsb3REZWxlZ2F0ZShFeGVjU3RhdGUqIHN0YXRlLCBQcm9wZXJ0eU5h bWUgcHJvcGUKICAgICBpZiAoQmluZGluZ1NlY3VyaXR5OjpzaG91bGRBbGxvd0FjY2Vzc1RvRnJh bWUoKnN0YXRlLCAqZnJhbWUsIG1lc3NhZ2UpKQogICAgICAgICByZXR1cm4gZmFsc2U7CiAKKyAg ICAvLyBodHRwczovL2h0bWwuc3BlYy53aGF0d2cub3JnLyNjcm9zc29yaWdpbmdldG93bnByb3Bl cnR5aGVscGVyLSgtbywtcC0pCiAgICAgaWYgKHByb3BlcnR5TmFtZSA9PSBzdGF0ZS0+cHJvcGVy dHlOYW1lcygpLnRvU3RyaW5nVGFnU3ltYm9sIHx8IHByb3BlcnR5TmFtZSA9PSBzdGF0ZS0+cHJv cGVydHlOYW1lcygpLmhhc0luc3RhbmNlU3ltYm9sIHx8IHByb3BlcnR5TmFtZSA9PSBzdGF0ZS0+ cHJvcGVydHlOYW1lcygpLmlzQ29uY2F0U3ByZWFkYWJsZVN5bWJvbCkgewotICAgICAgICBzbG90 LnNldFVuZGVmaW5lZCgpOworICAgICAgICBzbG90LnNldFZhbHVlKHRoaXMsIFJlYWRPbmx5IHwg RG9udEVudW0sIGpzVW5kZWZpbmVkKCkpOwogICAgICAgICByZXR1cm4gdHJ1ZTsKICAgICB9CiAK ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2ltcG9ydGVkL3czYy9DaGFuZ2VMb2cgYi9MYXlvdXRU ZXN0cy9pbXBvcnRlZC93M2MvQ2hhbmdlTG9nCmluZGV4IDQyNmYyY2EyYzFkYTAwYmZmMzE5Yzk2 YjJmYzk0ZGYwMDdiY2MyMDUuLjgwNTMxOGEyZGE0NDMyYTZmZGYxMzM0ZDBkODI1OTk5NzllZmIw NDAgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL2ltcG9ydGVkL3czYy9DaGFuZ2VMb2cKKysrIGIv TGF5b3V0VGVzdHMvaW1wb3J0ZWQvdzNjL0NoYW5nZUxvZwpAQCAtMSw1ICsxLDE2IEBACiAyMDE3 LTAyLTA2ICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKKyAgICAgICAgU3ltYm9s cyBleHBvc2VkIG9uIGNyb3NzLW9yaWdpbiBXaW5kb3cgLyBMb2NhdGlvbiBvYmplY3RzIHNob3Vs ZCBiZSBjb25maWd1cmFibGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTE2NzkyMAorCisgICAgICAgIFJldmlld2VkIGJ5IFJ5b3N1a2UgTml3YS4KKwor ICAgICAgICBSZWJhc2VsaW5lIHdlYiBwbGF0Zm9ybSB0ZXN0IG5vdyB0aGF0IG1vcmUgY2hlY2tz IGFyZSBwYXNzaW5nLgorCisgICAgICAgICogd2ViLXBsYXRmb3JtLXRlc3RzL2h0bWwvYnJvd3Nl cnMvb3JpZ2luL2Nyb3NzLW9yaWdpbi1vYmplY3RzL2Nyb3NzLW9yaWdpbi1vYmplY3RzLWV4cGVj dGVkLnR4dDoKKworMjAxNy0wMi0wNiAgQ2hyaXMgRHVtZXogIDxjZHVtZXpAYXBwbGUuY29tPgor CiAgICAgICAgIE9iamVjdC5wcmV2ZW50RXh0ZW5zaW9ucygpIG9uIGEgTG9jYXRpb24gb2JqZWN0 IHNob3VsZCB0aHJvdyBhIFR5cGVFcnJvcgogICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTY3OTE3CiAKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2ltcG9y dGVkL3czYy93ZWItcGxhdGZvcm0tdGVzdHMvaHRtbC9icm93c2Vycy9vcmlnaW4vY3Jvc3Mtb3Jp Z2luLW9iamVjdHMvY3Jvc3Mtb3JpZ2luLW9iamVjdHMtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVz dHMvaW1wb3J0ZWQvdzNjL3dlYi1wbGF0Zm9ybS10ZXN0cy9odG1sL2Jyb3dzZXJzL29yaWdpbi9j cm9zcy1vcmlnaW4tb2JqZWN0cy9jcm9zcy1vcmlnaW4tb2JqZWN0cy1leHBlY3RlZC50eHQKaW5k ZXggNGJjMmFiZTk1ZmIxMzFkNGJmMWY1YWRkNDM1NDUzNmFjYWU2MjU5Ny4uYmU1OTU3Njk5YWRl ODU3NTUwNjViYjUyNzMxZjU3OTkxZGRhOGE5NiAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvaW1w b3J0ZWQvdzNjL3dlYi1wbGF0Zm9ybS10ZXN0cy9odG1sL2Jyb3dzZXJzL29yaWdpbi9jcm9zcy1v cmlnaW4tb2JqZWN0cy9jcm9zcy1vcmlnaW4tb2JqZWN0cy1leHBlY3RlZC50eHQKKysrIGIvTGF5 b3V0VGVzdHMvaW1wb3J0ZWQvdzNjL3dlYi1wbGF0Zm9ybS10ZXN0cy9odG1sL2Jyb3dzZXJzL29y aWdpbi9jcm9zcy1vcmlnaW4tb2JqZWN0cy9jcm9zcy1vcmlnaW4tb2JqZWN0cy1leHBlY3RlZC50 eHQKQEAgLTE1LDggKzE1LDggQEAgUEFTUyBbW1ByZXZlbnRFeHRlbnNpb25zXV0gc2hvdWxkIHRo cm93IGZvciBjcm9zcy1vcmlnaW4gb2JqZWN0cwogUEFTUyBbW1ByZXZlbnRFeHRlbnNpb25zXV0g c2hvdWxkIHRocm93IGZvciBjcm9zcy1vcmlnaW4gb2JqZWN0cyAoZXhjZXB0aW9uIHR5cGUpIAog UEFTUyBbW0dldE93blByb3BlcnR5XV0gLSBQcm9wZXJ0aWVzIG9uIGNyb3NzLW9yaWdpbiBvYmpl Y3RzIHNob3VsZCBiZSByZXBvcnRlZCB8b3dufCAKIFBBU1MgW1tHZXRPd25Qcm9wZXJ0eV1dIC0g UHJvcGVydGllcyBvbiBjcm9zcy1vcmlnaW4gb2JqZWN0cyBzaG91bGQgYmUgcmVwb3J0ZWQgfG93 bnwgKGV4Y2VwdGlvbiB0eXBlKSAKLUZBSUwgW1tHZXRPd25Qcm9wZXJ0eV1dIC0gUHJvcGVydHkg ZGVzY3JpcHRvcnMgZm9yIGNyb3NzLW9yaWdpbiBwcm9wZXJ0aWVzIHNob3VsZCBiZSBzZXQgdXAg Y29ycmVjdGx5IGFzc2VydF9lcXVhbHM6IHByb3BlcnR5IGRlc2NyaXB0b3IgZm9yIFN5bWJvbChT eW1ib2wudG9TdHJpbmdUYWcpIHNob3VsZCBiZSBjb25maWd1cmFibGUgZXhwZWN0ZWQgdHJ1ZSBi dXQgZ290IGZhbHNlCi1GQUlMIFtbR2V0T3duUHJvcGVydHldXSAtIFByb3BlcnR5IGRlc2NyaXB0 b3JzIGZvciBjcm9zcy1vcmlnaW4gcHJvcGVydGllcyBzaG91bGQgYmUgc2V0IHVwIGNvcnJlY3Rs eSAoZXhjZXB0aW9uIHR5cGUpIGFzc2VydF91bnJlYWNoZWQ6IE1haW4gdGVzdCBmYWlsZWQgUmVh Y2hlZCB1bnJlYWNoYWJsZSBjb2RlCitQQVNTIFtbR2V0T3duUHJvcGVydHldXSAtIFByb3BlcnR5 IGRlc2NyaXB0b3JzIGZvciBjcm9zcy1vcmlnaW4gcHJvcGVydGllcyBzaG91bGQgYmUgc2V0IHVw IGNvcnJlY3RseSAKK1BBU1MgW1tHZXRPd25Qcm9wZXJ0eV1dIC0gUHJvcGVydHkgZGVzY3JpcHRv cnMgZm9yIGNyb3NzLW9yaWdpbiBwcm9wZXJ0aWVzIHNob3VsZCBiZSBzZXQgdXAgY29ycmVjdGx5 IChleGNlcHRpb24gdHlwZSkgCiBQQVNTIFtbRGVsZXRlXV0gU2hvdWxkIHRocm93IG9uIGNyb3Nz LW9yaWdpbiBvYmplY3RzIAogUEFTUyBbW0RlbGV0ZV1dIFNob3VsZCB0aHJvdyBvbiBjcm9zcy1v cmlnaW4gb2JqZWN0cyAoZXhjZXB0aW9uIHR5cGUpIAogUEFTUyBbW0RlZmluZU93blByb3BlcnR5 XV0gU2hvdWxkIHRocm93IGZvciBjcm9zcy1vcmlnaW4gb2JqZWN0cyAK