211603 2020-05-07 16:31:59 -0700 Limit HTTP referer to 4kb 2020-05-20 17:19:20 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=211731 https://bugs.webkit.org/show_bug.cgi?id=212180 InRadar P2 Normal --- 1 achristensen achristensen ap bfulgham cdumez darin ggaren webkit-bug-importer wilander youennf oldest_to_newest 1650411 0 achristensen 2020-05-07 16:31:59 -0700 Limit HTTP referer to 4kb 1650413 1 398811 achristensen 2020-05-07 16:38:25 -0700 Created attachment 398811 Patch 1650430 2 398811 ap 2020-05-07 17:29:09 -0700 Comment on attachment 398811 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=398811&action=review > Source/WebCore/ChangeLog:9 > + Use the origin if it's longer, unless the origin is too long. What do other browsers do? > Tools/TestWebKitAPI/Tests/WebKitCocoa/NetworkProcess.mm:49 > +TEST(WebKit, HTTPReferer) Can this be a layout test? API tests are bad news each time. 1650469 3 398811 achristensen 2020-05-07 19:26:24 -0700 Comment on attachment 398811 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=398811&action=review >> Source/WebCore/ChangeLog:9 >> + Use the origin if it's longer, unless the origin is too long. > > What do other browsers do? They do this. See https://bugzilla.mozilla.org/show_bug.cgi?id=1557346 >> Tools/TestWebKitAPI/Tests/WebKitCocoa/NetworkProcess.mm:49 >> +TEST(WebKit, HTTPReferer) > > Can this be a layout test? API tests are bad news each time. We could test long referrers in layout tests with queries instead of paths, but we cannot test the behavior of long hosts in layout tests because we are limited to 127.0.0.1 and localhost. If you feel strongly enough that this should sacrifice test coverage to be a layout test I'll do it, but I find this superior. > Tools/TestWebKitAPI/Tests/WebKitCocoa/NetworkProcess.mm:58 > + WTFLogAlways("REQUEST %s", request.data()); I will remove this before committing. 1650635 4 ap 2020-05-08 09:34:46 -0700 I don't feel very strongly about this particular case, but API tests are slow, and we have no path towards making them fast. So if we keep adding them, eventually we'll have to stop running them or something. 1650637 5 achristensen 2020-05-08 09:36:21 -0700 We should make a path towards making them fast. Most of them can be run in parallel, and those that can't should be marked as such. AP, how would you feel about reviewing this patch? 1650649 6 ap 2020-05-08 09:54:04 -0700 > We should make a path towards making them fast. I doubt that this "should" will turn into "have done". I can r+ with a layout test, but won't stop others from reviewing. 1650667 7 398811 cdumez 2020-05-08 10:21:21 -0700 Comment on attachment 398811 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=398811&action=review >>> Source/WebCore/ChangeLog:9 >>> + Use the origin if it's longer, unless the origin is too long. >> >> What do other browsers do? > > They do this. See https://bugzilla.mozilla.org/show_bug.cgi?id=1557346 Please update the change log to indicate that. > Source/WebCore/platform/network/ResourceRequestBase.cpp:382 > + String origin = SecurityOrigin::create(URL(URL(), httpReferrer))->toString(); Please add release logging (maybe even release error logging) to indicate that this is happening, in case we have to investigate regressions caused by this. 1650676 8 398874 achristensen 2020-05-08 10:35:42 -0700 Created attachment 398874 Patch 1650713 9 ews-feeder 2020-05-08 12:39:47 -0700 Committed r261402: <https://trac.webkit.org/changeset/261402> All reviewed patches have been landed. Closing bug and clearing flags on attachment 398874. 1650714 10 webkit-bug-importer 2020-05-08 12:40:14 -0700 <rdar://problem/63032015> 1650753 11 achristensen 2020-05-08 13:58:30 -0700 https://trac.webkit.org/changeset/261414/webkit 1650763 12 398874 darin 2020-05-08 14:21:21 -0700 Comment on attachment 398874 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=398874&action=review > Source/WebCore/platform/network/ResourceRequestBase.cpp:381 > + const size_t maxLength = 4096; New code should use constexpr. > Source/WebCore/platform/network/ResourceRequestBase.cpp:383 > + RELEASE_LOG(Loading, "Truncating HTTP referer"); Could be better if we logged different messages if we truncate to origin, or if we don’t set Referer at all. 1650901 13 398874 youennf 2020-05-09 02:51:13 -0700 Comment on attachment 398874 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=398874&action=review > Source/WebCore/ChangeLog:11 > + See https://bugzilla.mozilla.org/show_bug.cgi?id=1557346 Would have been good to refer to https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer which describes this behavior. I believe this impacts service workers. Is there a way we can add a test checking the fetch event request referrer as well (and verify other browsers behave the same)? It seems a bit sad that this particular restriction is visible from service worker, especially since there may be some user agent specific restrictions, but that is what the spec mandates currently. > Source/WebCore/platform/network/ResourceRequestBase.cpp:386 > + setHTTPHeaderField(HTTPHeaderName::Referer, origin); This does not seem to be described by the spec although we can do it as per step 7. Also if the origin value is too long, what can we do about the Origin header? 398811 2020-05-07 16:38:25 -0700 2020-05-08 10:35:40 -0700 Patch bug-211603-20200507163825.patch text/plain 5295 achristensen SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI2MTI5OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDIwLTA1LTA3ICBBbGV4IENo cmlzdGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgTGltaXQgSFRU UCByZWZlcmVyIHRvIDRrYgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MjExNjAzCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS81Njc2ODgyMz4KKworICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBVc2UgdGhlIG9yaWdp biBpZiBpdCdzIGxvbmdlciwgdW5sZXNzIHRoZSBvcmlnaW4gaXMgdG9vIGxvbmcuCisgICAgICAg IFRlc3RlZCBieSBBUEkgdGVzdHMuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9uZXR3b3JrL1Jlc291 cmNlUmVxdWVzdEJhc2UuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVzb3VyY2VSZXF1ZXN0QmFz ZTo6c2V0SFRUUFJlZmVycmVyKToKKwogMjAyMC0wNS0wNyAgWmFsYW4gQnVqdGFzICA8emFsYW5A YXBwbGUuY29tPgogCiAgICAgICAgIFtMRkNdW1RGQ10gU2V0IHNlY3Rpb24gW3RvcCwgbGVmdF0g dXNlZCBwb3NpdGlvbi4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL25ldHdvcmsvUmVz b3VyY2VSZXF1ZXN0QmFzZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvcGxhdGZv cm0vbmV0d29yay9SZXNvdXJjZVJlcXVlc3RCYXNlLmNwcAkocmV2aXNpb24gMjYxMjk4KQorKysg U291cmNlL1dlYkNvcmUvcGxhdGZvcm0vbmV0d29yay9SZXNvdXJjZVJlcXVlc3RCYXNlLmNwcAko d29ya2luZyBjb3B5KQpAQCAtMzAsNiArMzAsNyBAQAogI2luY2x1ZGUgIlB1YmxpY1N1ZmZpeC5o IgogI2luY2x1ZGUgIlJlc291cmNlUmVxdWVzdC5oIgogI2luY2x1ZGUgIlJlc291cmNlUmVzcG9u c2UuaCIKKyNpbmNsdWRlICJTZWN1cml0eU9yaWdpbi5oIgogI2luY2x1ZGUgIlNlY3VyaXR5UG9s aWN5LmgiCiAjaW5jbHVkZSA8d3RmL1BvaW50ZXJDb21wYXJpc29uLmg+CiAKQEAgLTM3Niw3ICsz NzcsMTMgQEAgYm9vbCBSZXNvdXJjZVJlcXVlc3RCYXNlOjpoYXNIVFRQUmVmZXJyZQogCiB2b2lk IFJlc291cmNlUmVxdWVzdEJhc2U6OnNldEhUVFBSZWZlcnJlcihjb25zdCBTdHJpbmcmIGh0dHBS ZWZlcnJlcikKIHsKLSAgICBzZXRIVFRQSGVhZGVyRmllbGQoSFRUUEhlYWRlck5hbWU6OlJlZmVy ZXIsIGh0dHBSZWZlcnJlcik7CisgICAgY29uc3Qgc2l6ZV90IG1heExlbmd0aCA9IDQwOTY7Cisg ICAgaWYgKGh0dHBSZWZlcnJlci5sZW5ndGgoKSA+IG1heExlbmd0aCkgeworICAgICAgICBTdHJp bmcgb3JpZ2luID0gU2VjdXJpdHlPcmlnaW46OmNyZWF0ZShVUkwoVVJMKCksIGh0dHBSZWZlcnJl cikpLT50b1N0cmluZygpOworICAgICAgICBpZiAob3JpZ2luLmxlbmd0aCgpIDw9IG1heExlbmd0 aCkKKyAgICAgICAgICAgIHNldEhUVFBIZWFkZXJGaWVsZChIVFRQSGVhZGVyTmFtZTo6UmVmZXJl ciwgb3JpZ2luKTsKKyAgICB9IGVsc2UKKyAgICAgICAgc2V0SFRUUEhlYWRlckZpZWxkKEhUVFBI ZWFkZXJOYW1lOjpSZWZlcmVyLCBodHRwUmVmZXJyZXIpOwogfQogCiB2b2lkIFJlc291cmNlUmVx dWVzdEJhc2U6OnNldEV4aXN0aW5nSFRUUFJlZmVycmVyVG9PcmlnaW5TdHJpbmcoKQpJbmRleDog VG9vbHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFRvb2xzL0NoYW5nZUxvZwkocmV2aXNpb24g MjYxMzQ0KQorKysgVG9vbHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQg QEAKKzIwMjAtMDUtMDcgIEFsZXggQ2hyaXN0ZW5zZW4gIDxhY2hyaXN0ZW5zZW5Ad2Via2l0Lm9y Zz4KKworICAgICAgICBMaW1pdCBIVFRQIHJlZmVyZXIgdG8gNGtiCisgICAgICAgIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMTE2MDMKKyAgICAgICAgPHJkYXI6Ly9w cm9ibGVtLzU2NzY4ODIzPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor CisgICAgICAgICogVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJLaXRDb2NvYS9OZXR3b3JrUHJvY2Vz cy5tbToKKyAgICAgICAgKFRFU1QpOgorCiAyMDIwLTA1LTA3ICBKb25hdGhhbiBCZWRhcmQgIDxq YmVkYXJkQGFwcGxlLmNvbT4KIAogICAgICAgICB3ZWJraXRweTogVXNlIGFwcGxlX2FkZGl0aW9u cyBjZXJ0aWZpY2F0ZSBwYXRoIGlmIGF2YWlsYWJsZQpJbmRleDogVG9vbHMvVGVzdFdlYktpdEFQ SS9UZXN0cy9XZWJLaXRDb2NvYS9OZXR3b3JrUHJvY2Vzcy5tbQo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29s cy9UZXN0V2ViS2l0QVBJL1Rlc3RzL1dlYktpdENvY29hL05ldHdvcmtQcm9jZXNzLm1tCShyZXZp c2lvbiAyNjEyOTgpCisrKyBUb29scy9UZXN0V2ViS2l0QVBJL1Rlc3RzL1dlYktpdENvY29hL05l dHdvcmtQcm9jZXNzLm1tCSh3b3JraW5nIGNvcHkpCkBAIC0yNSw4ICsyNSwxMSBAQAogCiAjaW1w b3J0ICJjb25maWcuaCIKIAorI2ltcG9ydCAiSFRUUFNlcnZlci5oIgogI2ltcG9ydCAiVGVzdFdL V2ViVmlldy5oIgorI2ltcG9ydCAiVXRpbGl0aWVzLmgiCiAjaW1wb3J0IDxXZWJLaXQvV0tQcm9j ZXNzUG9vbFByaXZhdGUuaD4KKyNpbXBvcnQgPHd0Zi9CbG9ja1B0ci5oPgogI2ltcG9ydCA8d3Rm L1JldGFpblB0ci5oPgogCiBURVNUKFdlYktpdCwgTmV0d29ya1Byb2Nlc3NFbnRpdGxlbWVudHMp CkBAIC00MiwzICs0NSwzOCBAQCBURVNUKFdlYktpdCwgTmV0d29ya1Byb2Nlc3NFbnRpdGxlbWVu dHMpCiAjZW5kaWYKICAgICBFWFBFQ1RfRkFMU0UoW3Bvb2wgX25ldHdvcmtQcm9jZXNzSGFzRW50 aXRsZW1lbnRGb3JUZXN0aW5nOkAidGVzdCBmYWlsdXJlIGNhc2UiXSk7CiB9CisKK1RFU1QoV2Vi S2l0LCBIVFRQUmVmZXJlcikKK3sKKyAgICBhdXRvIGNoZWNrUmVmZXJlciA9IFtdIChOU1VSTCAq YmFzZVVSTCwgY29uc3QgY2hhciogZXhwZWN0ZWRSZWZlcmVyKSB7CisgICAgICAgIHVzaW5nIG5h bWVzcGFjZSBUZXN0V2ViS2l0QVBJOworICAgICAgICBib29sIGRvbmUgPSBmYWxzZTsKKyAgICAg ICAgSFRUUFNlcnZlciBzZXJ2ZXIoW2RvbmUgPSAmZG9uZSwgZXhwZWN0ZWRSZWZlcmVyXSAobndf Y29ubmVjdGlvbl90IGNvbm5lY3Rpb24pIHsKKyAgICAgICAgICAgIG53X2Nvbm5lY3Rpb25fcmVj ZWl2ZShjb25uZWN0aW9uLCAxLCBzdGQ6Om51bWVyaWNfbGltaXRzPHVpbnQzMl90Pjo6bWF4KCks IG1ha2VCbG9ja1B0cihbY29ubmVjdGlvbiA9IHJldGFpblB0cihjb25uZWN0aW9uKSwgZG9uZSwg ZXhwZWN0ZWRSZWZlcmVyXShkaXNwYXRjaF9kYXRhX3QgY29udGVudCwgbndfY29udGVudF9jb250 ZXh0X3QsIGJvb2wsIG53X2Vycm9yX3QpIHsKKyAgICAgICAgICAgICAgICBFWFBFQ1RfVFJVRShj b250ZW50KTsKKyAgICAgICAgICAgICAgICBhdXRvIHJlcXVlc3QgPSBudWxsVGVybWluYXRlZFJl cXVlc3QoY29udGVudCk7CisgICAgICAgICAgICAgICAgV1RGTG9nQWx3YXlzKCJSRVFVRVNUICVz IiwgcmVxdWVzdC5kYXRhKCkpOworICAgICAgICAgICAgICAgIGlmIChleHBlY3RlZFJlZmVyZXIp IHsKKyAgICAgICAgICAgICAgICAgICAgYXV0byBleHBlY3RlZEhlYWRlckZpZWxkID0gbWFrZVN0 cmluZygiUmVmZXJlcjogIiwgZXhwZWN0ZWRSZWZlcmVyLCAiXHJcbiIpOworICAgICAgICAgICAg ICAgICAgICBFWFBFQ1RfVFJVRShzdHJzdHIocmVxdWVzdC5kYXRhKCksIGV4cGVjdGVkSGVhZGVy RmllbGQudXRmOCgpLmRhdGEoKSkpOworICAgICAgICAgICAgICAgIH0gZWxzZQorICAgICAgICAg ICAgICAgICAgICBFWFBFQ1RfRkFMU0Uoc3Ryc3RyKHJlcXVlc3QuZGF0YSgpLCAiUmVmZXJlcjoi KSk7CisgICAgICAgICAgICAgICAgKmRvbmUgPSB0cnVlOworICAgICAgICAgICAgfSkuZ2V0KCkp OworICAgICAgICB9KTsKKyAgICAgICAgYXV0byB3ZWJWaWV3ID0gYWRvcHROUyhbV0tXZWJWaWV3 IG5ld10pOworICAgICAgICBbd2ViVmlldyBsb2FkSFRNTFN0cmluZzpbTlNTdHJpbmcgc3RyaW5n V2l0aEZvcm1hdDpAIjxib2R5IG9ubG9hZD0nZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoXCJmb3Jt SURcIikuc3VibWl0KCknPjxmb3JtIGlkPSdmb3JtSUQnIG1ldGhvZD0ncG9zdCcgYWN0aW9uPSdo dHRwOi8vMTI3LjAuMC4xOiVkLyc+PC9mb3JtPjwvYm9keT4iLCBzZXJ2ZXIucG9ydCgpXSBiYXNl VVJMOmJhc2VVUkxdOworICAgICAgICBVdGlsOjpydW4oJmRvbmUpOworICAgIH07CisgICAgCisg ICAgVmVjdG9yPGNoYXI+IGE1ayg1MDAwLCAnYScpOworICAgIFZlY3RvcjxjaGFyPiBhM2soMzAw MCwgJ2EnKTsKKyAgICBOU1N0cmluZyAqbG9uZ1BhdGggPSBbTlNTdHJpbmcgc3RyaW5nV2l0aEZv cm1hdDpAImh0dHA6Ly93ZWJraXQub3JnLyVzIiwgYTVrLmRhdGEoKV07CisgICAgTlNTdHJpbmcg KnNob3J0ZXJQYXRoID0gW05TU3RyaW5nIHN0cmluZ1dpdGhGb3JtYXQ6QCJodHRwOi8vd2Via2l0 Lm9yZy8lcyIsIGEzay5kYXRhKCldOworICAgIE5TU3RyaW5nICpsb25nSG9zdCA9IFtOU1N0cmlu ZyBzdHJpbmdXaXRoRm9ybWF0OkAiaHR0cDovL3dlYmtpdC5vcmclcy9wYXRoIiwgYTVrLmRhdGEo KV07CisgICAgTlNTdHJpbmcgKnNob3J0ZXJIb3N0ID0gW05TU3RyaW5nIHN0cmluZ1dpdGhGb3Jt YXQ6QCJodHRwOi8vd2Via2l0Lm9yZyVzL3BhdGgiLCBhM2suZGF0YSgpXTsKKyAgICBjaGVja1Jl ZmVyZXIoW05TVVJMIFVSTFdpdGhTdHJpbmc6bG9uZ1BhdGhdLCAiaHR0cDovL3dlYmtpdC5vcmci KTsKKyAgICBjaGVja1JlZmVyZXIoW05TVVJMIFVSTFdpdGhTdHJpbmc6c2hvcnRlclBhdGhdLCBz aG9ydGVyUGF0aC5VVEY4U3RyaW5nKTsKKyAgICBjaGVja1JlZmVyZXIoW05TVVJMIFVSTFdpdGhT dHJpbmc6bG9uZ0hvc3RdLCBudWxscHRyKTsKKyAgICBjaGVja1JlZmVyZXIoW05TVVJMIFVSTFdp dGhTdHJpbmc6c2hvcnRlckhvc3RdLCBzaG9ydGVySG9zdC5VVEY4U3RyaW5nKTsKK30K 398874 2020-05-08 10:35:42 -0700 2020-05-08 12:39:48 -0700 Patch bug-211603-20200508103541.patch text/plain 5507 achristensen SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI2MTI5OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisyMDIwLTA1LTA3ICBBbGV4IENo cmlzdGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgTGltaXQgSFRU UCByZWZlcmVyIHRvIDRrYgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MjExNjAzCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS81Njc2ODgyMz4KKworICAg ICAgICBSZXZpZXdlZCBieSBDaHJpcyBEdW1lei4KKworICAgICAgICBVc2UgdGhlIG9yaWdpbiBp ZiBpdCdzIGxvbmdlciwgdW5sZXNzIHRoZSBvcmlnaW4gaXMgdG9vIGxvbmcuCisgICAgICAgIFRo aXMgbWF0Y2hlcyB0aGUgYmVoYXZpb3Igb2Ygb3RoZXIgYnJvd3NlcnMuCisgICAgICAgIFNlZSBo dHRwczovL2J1Z3ppbGxhLm1vemlsbGEub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTU3MzQ2CisKKyAg ICAgICAgVGVzdGVkIGJ5IEFQSSB0ZXN0cy4KKworICAgICAgICAqIHBsYXRmb3JtL25ldHdvcmsv UmVzb3VyY2VSZXF1ZXN0QmFzZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSZXNvdXJjZVJlcXVl c3RCYXNlOjpzZXRIVFRQUmVmZXJyZXIpOgorCiAyMDIwLTA1LTA3ICBaYWxhbiBCdWp0YXMgIDx6 YWxhbkBhcHBsZS5jb20+CiAKICAgICAgICAgW0xGQ11bVEZDXSBTZXQgc2VjdGlvbiBbdG9wLCBs ZWZ0XSB1c2VkIHBvc2l0aW9uLgpJbmRleDogU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vbmV0d29y ay9SZXNvdXJjZVJlcXVlc3RCYXNlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9w bGF0Zm9ybS9uZXR3b3JrL1Jlc291cmNlUmVxdWVzdEJhc2UuY3BwCShyZXZpc2lvbiAyNjEyOTgp CisrKyBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL1Jlc291cmNlUmVxdWVzdEJhc2Uu Y3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yNyw5ICsyNywxMSBAQAogI2luY2x1ZGUgIlJlc291cmNl UmVxdWVzdEJhc2UuaCIKIAogI2luY2x1ZGUgIkhUVFBIZWFkZXJOYW1lcy5oIgorI2luY2x1ZGUg IkxvZ2dpbmcuaCIKICNpbmNsdWRlICJQdWJsaWNTdWZmaXguaCIKICNpbmNsdWRlICJSZXNvdXJj ZVJlcXVlc3QuaCIKICNpbmNsdWRlICJSZXNvdXJjZVJlc3BvbnNlLmgiCisjaW5jbHVkZSAiU2Vj dXJpdHlPcmlnaW4uaCIKICNpbmNsdWRlICJTZWN1cml0eVBvbGljeS5oIgogI2luY2x1ZGUgPHd0 Zi9Qb2ludGVyQ29tcGFyaXNvbi5oPgogCkBAIC0zNzYsNyArMzc4LDE0IEBAIGJvb2wgUmVzb3Vy Y2VSZXF1ZXN0QmFzZTo6aGFzSFRUUFJlZmVycmUKIAogdm9pZCBSZXNvdXJjZVJlcXVlc3RCYXNl OjpzZXRIVFRQUmVmZXJyZXIoY29uc3QgU3RyaW5nJiBodHRwUmVmZXJyZXIpCiB7Ci0gICAgc2V0 SFRUUEhlYWRlckZpZWxkKEhUVFBIZWFkZXJOYW1lOjpSZWZlcmVyLCBodHRwUmVmZXJyZXIpOwor ICAgIGNvbnN0IHNpemVfdCBtYXhMZW5ndGggPSA0MDk2OworICAgIGlmIChodHRwUmVmZXJyZXIu bGVuZ3RoKCkgPiBtYXhMZW5ndGgpIHsKKyAgICAgICAgUkVMRUFTRV9MT0coTG9hZGluZywgIlRy dW5jYXRpbmcgSFRUUCByZWZlcmVyIik7CisgICAgICAgIFN0cmluZyBvcmlnaW4gPSBTZWN1cml0 eU9yaWdpbjo6Y3JlYXRlKFVSTChVUkwoKSwgaHR0cFJlZmVycmVyKSktPnRvU3RyaW5nKCk7Cisg ICAgICAgIGlmIChvcmlnaW4ubGVuZ3RoKCkgPD0gbWF4TGVuZ3RoKQorICAgICAgICAgICAgc2V0 SFRUUEhlYWRlckZpZWxkKEhUVFBIZWFkZXJOYW1lOjpSZWZlcmVyLCBvcmlnaW4pOworICAgIH0g ZWxzZQorICAgICAgICBzZXRIVFRQSGVhZGVyRmllbGQoSFRUUEhlYWRlck5hbWU6OlJlZmVyZXIs IGh0dHBSZWZlcnJlcik7CiB9CiAKIHZvaWQgUmVzb3VyY2VSZXF1ZXN0QmFzZTo6c2V0RXhpc3Rp bmdIVFRQUmVmZXJyZXJUb09yaWdpblN0cmluZygpCkluZGV4OiBUb29scy9DaGFuZ2VMb2cKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gVG9vbHMvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNjEzNDQpCisrKyBUb29scy9D aGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxNCBAQAorMjAyMC0wNS0wNyAgQWxl eCBDaHJpc3RlbnNlbiAgPGFjaHJpc3RlbnNlbkB3ZWJraXQub3JnPgorCisgICAgICAgIExpbWl0 IEhUVFAgcmVmZXJlciB0byA0a2IKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hv d19idWcuY2dpP2lkPTIxMTYwMworICAgICAgICA8cmRhcjovL3Byb2JsZW0vNTY3Njg4MjM+CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgQ2hyaXMgRHVtZXouCisKKyAgICAgICAgKiBUZXN0V2ViS2l0 QVBJL1Rlc3RzL1dlYktpdENvY29hL05ldHdvcmtQcm9jZXNzLm1tOgorICAgICAgICAoVEVTVCk6 CisKIDIwMjAtMDUtMDcgIEpvbmF0aGFuIEJlZGFyZCAgPGpiZWRhcmRAYXBwbGUuY29tPgogCiAg ICAgICAgIHdlYmtpdHB5OiBVc2UgYXBwbGVfYWRkaXRpb25zIGNlcnRpZmljYXRlIHBhdGggaWYg YXZhaWxhYmxlCkluZGV4OiBUb29scy9UZXN0V2ViS2l0QVBJL1Rlc3RzL1dlYktpdENvY29hL05l dHdvcmtQcm9jZXNzLm1tCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFRvb2xzL1Rlc3RXZWJLaXRBUEkvVGVzdHMv V2ViS2l0Q29jb2EvTmV0d29ya1Byb2Nlc3MubW0JKHJldmlzaW9uIDI2MTI5OCkKKysrIFRvb2xz L1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2ViS2l0Q29jb2EvTmV0d29ya1Byb2Nlc3MubW0JKHdvcmtp bmcgY29weSkKQEAgLTI1LDggKzI1LDExIEBACiAKICNpbXBvcnQgImNvbmZpZy5oIgogCisjaW1w b3J0ICJIVFRQU2VydmVyLmgiCiAjaW1wb3J0ICJUZXN0V0tXZWJWaWV3LmgiCisjaW1wb3J0ICJV dGlsaXRpZXMuaCIKICNpbXBvcnQgPFdlYktpdC9XS1Byb2Nlc3NQb29sUHJpdmF0ZS5oPgorI2lt cG9ydCA8d3RmL0Jsb2NrUHRyLmg+CiAjaW1wb3J0IDx3dGYvUmV0YWluUHRyLmg+CiAKIFRFU1Qo V2ViS2l0LCBOZXR3b3JrUHJvY2Vzc0VudGl0bGVtZW50cykKQEAgLTQyLDMgKzQ1LDM3IEBAIFRF U1QoV2ViS2l0LCBOZXR3b3JrUHJvY2Vzc0VudGl0bGVtZW50cykKICNlbmRpZgogICAgIEVYUEVD VF9GQUxTRShbcG9vbCBfbmV0d29ya1Byb2Nlc3NIYXNFbnRpdGxlbWVudEZvclRlc3Rpbmc6QCJ0 ZXN0IGZhaWx1cmUgY2FzZSJdKTsKIH0KKworVEVTVChXZWJLaXQsIEhUVFBSZWZlcmVyKQorewor ICAgIGF1dG8gY2hlY2tSZWZlcmVyID0gW10gKE5TVVJMICpiYXNlVVJMLCBjb25zdCBjaGFyKiBl eHBlY3RlZFJlZmVyZXIpIHsKKyAgICAgICAgdXNpbmcgbmFtZXNwYWNlIFRlc3RXZWJLaXRBUEk7 CisgICAgICAgIGJvb2wgZG9uZSA9IGZhbHNlOworICAgICAgICBIVFRQU2VydmVyIHNlcnZlcihb ZG9uZSA9ICZkb25lLCBleHBlY3RlZFJlZmVyZXJdIChud19jb25uZWN0aW9uX3QgY29ubmVjdGlv bikgeworICAgICAgICAgICAgbndfY29ubmVjdGlvbl9yZWNlaXZlKGNvbm5lY3Rpb24sIDEsIHN0 ZDo6bnVtZXJpY19saW1pdHM8dWludDMyX3Q+OjptYXgoKSwgbWFrZUJsb2NrUHRyKFtjb25uZWN0 aW9uID0gcmV0YWluUHRyKGNvbm5lY3Rpb24pLCBkb25lLCBleHBlY3RlZFJlZmVyZXJdKGRpc3Bh dGNoX2RhdGFfdCBjb250ZW50LCBud19jb250ZW50X2NvbnRleHRfdCwgYm9vbCwgbndfZXJyb3Jf dCkgeworICAgICAgICAgICAgICAgIEVYUEVDVF9UUlVFKGNvbnRlbnQpOworICAgICAgICAgICAg ICAgIGF1dG8gcmVxdWVzdCA9IG51bGxUZXJtaW5hdGVkUmVxdWVzdChjb250ZW50KTsKKyAgICAg ICAgICAgICAgICBpZiAoZXhwZWN0ZWRSZWZlcmVyKSB7CisgICAgICAgICAgICAgICAgICAgIGF1 dG8gZXhwZWN0ZWRIZWFkZXJGaWVsZCA9IG1ha2VTdHJpbmcoIlJlZmVyZXI6ICIsIGV4cGVjdGVk UmVmZXJlciwgIlxyXG4iKTsKKyAgICAgICAgICAgICAgICAgICAgRVhQRUNUX1RSVUUoc3Ryc3Ry KHJlcXVlc3QuZGF0YSgpLCBleHBlY3RlZEhlYWRlckZpZWxkLnV0ZjgoKS5kYXRhKCkpKTsKKyAg ICAgICAgICAgICAgICB9IGVsc2UKKyAgICAgICAgICAgICAgICAgICAgRVhQRUNUX0ZBTFNFKHN0 cnN0cihyZXF1ZXN0LmRhdGEoKSwgIlJlZmVyZXI6IikpOworICAgICAgICAgICAgICAgICpkb25l ID0gdHJ1ZTsKKyAgICAgICAgICAgIH0pLmdldCgpKTsKKyAgICAgICAgfSk7CisgICAgICAgIGF1 dG8gd2ViVmlldyA9IGFkb3B0TlMoW1dLV2ViVmlldyBuZXddKTsKKyAgICAgICAgW3dlYlZpZXcg bG9hZEhUTUxTdHJpbmc6W05TU3RyaW5nIHN0cmluZ1dpdGhGb3JtYXQ6QCI8Ym9keSBvbmxvYWQ9 J2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKFwiZm9ybUlEXCIpLnN1Ym1pdCgpJz48Zm9ybSBpZD0n Zm9ybUlEJyBtZXRob2Q9J3Bvc3QnIGFjdGlvbj0naHR0cDovLzEyNy4wLjAuMTolZC8nPjwvZm9y bT48L2JvZHk+Iiwgc2VydmVyLnBvcnQoKV0gYmFzZVVSTDpiYXNlVVJMXTsKKyAgICAgICAgVXRp bDo6cnVuKCZkb25lKTsKKyAgICB9OworICAgIAorICAgIFZlY3RvcjxjaGFyPiBhNWsoNTAwMCwg J2EnKTsKKyAgICBWZWN0b3I8Y2hhcj4gYTNrKDMwMDAsICdhJyk7CisgICAgTlNTdHJpbmcgKmxv bmdQYXRoID0gW05TU3RyaW5nIHN0cmluZ1dpdGhGb3JtYXQ6QCJodHRwOi8vd2Via2l0Lm9yZy8l cz9hc2RmIiwgYTVrLmRhdGEoKV07CisgICAgTlNTdHJpbmcgKnNob3J0ZXJQYXRoID0gW05TU3Ry aW5nIHN0cmluZ1dpdGhGb3JtYXQ6QCJodHRwOi8vd2Via2l0Lm9yZy8lcz9hc2RmIiwgYTNrLmRh dGEoKV07CisgICAgTlNTdHJpbmcgKmxvbmdIb3N0ID0gW05TU3RyaW5nIHN0cmluZ1dpdGhGb3Jt YXQ6QCJodHRwOi8vd2Via2l0Lm9yZyVzL3BhdGgiLCBhNWsuZGF0YSgpXTsKKyAgICBOU1N0cmlu ZyAqc2hvcnRlckhvc3QgPSBbTlNTdHJpbmcgc3RyaW5nV2l0aEZvcm1hdDpAImh0dHA6Ly93ZWJr aXQub3JnJXMvcGF0aCIsIGEzay5kYXRhKCldOworICAgIGNoZWNrUmVmZXJlcihbTlNVUkwgVVJM V2l0aFN0cmluZzpsb25nUGF0aF0sICJodHRwOi8vd2Via2l0Lm9yZyIpOworICAgIGNoZWNrUmVm ZXJlcihbTlNVUkwgVVJMV2l0aFN0cmluZzpzaG9ydGVyUGF0aF0sIHNob3J0ZXJQYXRoLlVURjhT dHJpbmcpOworICAgIGNoZWNrUmVmZXJlcihbTlNVUkwgVVJMV2l0aFN0cmluZzpsb25nSG9zdF0s IG51bGxwdHIpOworICAgIGNoZWNrUmVmZXJlcihbTlNVUkwgVVJMV2l0aFN0cmluZzpzaG9ydGVy SG9zdF0sIHNob3J0ZXJIb3N0LlVURjhTdHJpbmcpOworfQo=