54084 2011-02-09 02:23:25 -0800 Hostnames should cannonicalize to lowercase (to match every other browser) 2011-02-11 15:28:13 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 54318 1 eric eric abarth aroben commit-queue eric fishd jeffm mjs sam timothy oldest_to_newest 348089 0 eric 2011-02-09 02:23:25 -0800 Hostnames should cannonicalize to lowercase (to match every other browser) 348090 1 81777 eric 2011-02-09 02:24:19 -0800 Created attachment 81777 Patch 348150 2 81777 commit-queue 2011-02-09 04:13:39 -0800 Comment on attachment 81777 Patch Clearing flags on attachment: 81777 Committed r78044: <http://trac.webkit.org/changeset/78044> 348151 3 commit-queue 2011-02-09 04:13:43 -0800 All reviewed patches have been landed. Closing bug. 349207 4 timothy 2011-02-10 11:16:10 -0800 This caused regressions and breakage in Safari extensions. Extension URLs (based on bundle identifiers) are allowed to have only case differences. But now with this change the extension URLs conflict and no longer uniquely identify an extension. I'd like to propose this change only apply to http, https and maybe file URLs. It seems wrong to assume lowercase is correct for all other URL schemes. Does that seem okay to you Eric? 349314 5 abarth 2011-02-10 13:17:11 -0800 Can you give an example of a Safari extension URL? Quoting from http://www.ietf.org/rfc/rfc2396.txt ---8<--- The URI syntax is dependent upon the scheme. In general, absolute URI are written as follows: <scheme>:<scheme-specific-part> An absolute URI contains the name of the scheme being used (<scheme>) followed by a colon (":") and then a string (the <scheme-specific- part>) whose interpretation depends on the scheme. The URI syntax does not require that the scheme-specific-part have any general structure or set of semantics which is common among all URI. However, a subset of URI do share a common syntax for representing hierarchical relationships within the namespace. This "generic URI" syntax consists of a sequence of four main components: <scheme>://<authority><path>?<query> each of which, except <scheme>, may be absent from a particular URI. For example, some URI schemes do not allow an <authority> component, and others do not use a <query> component. --->8---- In particular, the question is what sort of URI these things are. 349319 6 timothy 2011-02-10 13:24:37 -0800 They are hierarchical. safari-extension://com.apple.Safari.Test-8Y3CDS73R8/cf03fc47/test.html 349439 7 abarth 2011-02-10 15:33:32 -0800 Ok. We can change KURL to be more selective about which schemes it canonicalizes. However, please be aware that extensions whose authority differ only in case will not be properly isolated from each other by the web platform. In particular, they'll inhabit the same security origin, which means they can XSS each other. Also, they'll share persistent storage, such as localStorage. Another note: because you've reversed the dotted authority hierarchy, there could be serious negative security interactions with with cookies and document.domain (as well as other security features that attempt to understand the DNS hierarchy). 349440 8 abarth 2011-02-10 15:34:03 -0800 +sam because there are interactions with SecurityOrigin canonicalization too. 349446 9 aroben 2011-02-10 15:36:45 -0800 (In reply to comment #7) > Ok. We can change KURL to be more selective about which schemes it canonicalizes. However, please be aware that extensions whose authority differ only in case will not be properly isolated from each other by the web platform. In particular, they'll inhabit the same security origin, which means they can XSS each other. Also, they'll share persistent storage, such as localStorage. This is good to know, and may require us to make changes in Safari. > Another note: because you've reversed the dotted authority hierarchy, there could be serious negative security interactions with with cookies and document.domain (as well as other security features that attempt to understand the DNS hierarchy). We're aware of that, and are using SecurityOrigin's "domain relaxation forbidden" concept to try to head off problems here. (In fact, this is what that concept was added for.) 349638 10 eric 2011-02-10 21:51:50 -0800 Filed bug 54271 about making a special case for safari-extension. I'll write up a patch tomorrow. 349639 11 eric 2011-02-10 21:53:02 -0800 @abarth: Do we need to file bugs about the possible security issues with safari-extension? Would you be willing to file those bugs? 349643 12 abarth 2011-02-10 22:08:29 -0800 (In reply to comment #11) > @abarth: Do we need to file bugs about the possible security issues with safari-extension? Would you be willing to file those bugs? I don't know enough of the details to answer that question. If there's a problem, the solution is also likely to be in the Safari layer rather than the WebKit layer. I'll defer to folks who know more about these things to assess whether these issues are actually problematic. 349758 13 aroben 2011-02-11 07:01:46 -0800 I filed <rdar://problem/8988695> to cover the Safari issues. 81777 2011-02-09 02:24:19 -0800 2011-02-09 04:13:39 -0800 Patch bug-54084-20110209022417.patch text/plain 14203 eric U3VidmVyc2lvbiBSZXZpc2lvbjogNzgwMzIKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCA3OGQwY2E2ZTBmNTE2NmU1Yjg0ZWRk ZmY2YzJiYTdjYzJmYTZmODIzLi5kOTEzY2I4MzYyMjgxM2QwNjFhY2I5OWU5YzZmMjI4YzQxNjlk ODkxIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTEtMDItMDkgIEVyaWMgU2VpZGVsICA8ZXJp Y0B3ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIEhvc3RuYW1lcyBzaG91bGQgY2Fubm9uaWNhbGl6ZSB0byBsb3dlcmNhc2UgKHRvIG1h dGNoIGV2ZXJ5IG90aGVyIGJyb3dzZXIpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD01NDA4NAorCisgICAgICAgIFByZXR0eSBvYnZpb3VzIGNoYW5nZS4g IEtVUkwgaXMgdGhlIG9kZCBtYW4gb3V0IGhlcmUuCisKKyAgICAgICAgKiBmYXN0L3VybC9ob3N0 LWV4cGVjdGVkLnR4dDoKKyAgICAgICAgKiBmYXN0L3VybC9pcHY0LWV4cGVjdGVkLnR4dDoKKyAg ICAgICAgKiBmYXN0L3VybC9pcHY2LWV4cGVjdGVkLnR4dDoKKyAgICAgICAgKiBmYXN0L3VybC9y ZWxhdGl2ZS1leHBlY3RlZC50eHQ6CisgICAgICAgICogZmFzdC91cmwvcmVsYXRpdmUtdW5peC1l eHBlY3RlZC50eHQ6CisgICAgICAgICogZmFzdC91cmwvc3RhbmRhcmQtdXJsLWV4cGVjdGVkLnR4 dDoKKwogMjAxMS0wMi0wOSAgSWx5YSBUaWtob25vdnNreSAgPGxvaXNsb0BjaHJvbWl1bS5vcmc+ CiAKICAgICAgICAgVW5yZXZpZXdlZC4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvdXJs L2hvc3QtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC91cmwvaG9zdC1leHBlY3RlZC50 eHQKaW5kZXggYWZjYTllZGI4ZmE3Nzk1MzFmZWZkOGRjZjY5NzgzODBlNzUzNGJjMS4uYTVjM2Y1 MWQxZWNkNjRhMDUxMWJiMTg1NjU0YWVhODZhNTk0NzUwNiAxMDA2NDQKLS0tIGEvTGF5b3V0VGVz dHMvZmFzdC91cmwvaG9zdC1leHBlY3RlZC50eHQKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC91cmwv aG9zdC1leHBlY3RlZC50eHQKQEAgLTMsNyArMyw3IEBAIENhbm9uaWNhbGl6YXRpb24gb2YgaG9z dCBuYW1lcy4KIE9uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIgbWVz c2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KIAogCi1GQUlMIGNhbm9uaWNhbGl6 ZSgnaHR0cDovL0dvT2dMZS5Db00vJykgc2hvdWxkIGJlIGh0dHA6Ly9nb29nbGUuY29tLy4gV2Fz IGh0dHA6Ly9Hb09nTGUuQ29NLy4KK1BBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vR29PZ0xlLkNv TS8nKSBpcyAnaHR0cDovL2dvb2dsZS5jb20vJwogRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly9H b28lMjAgZ29vJTdDfC5jb20vJykgc2hvdWxkIGJlIGh0dHA6Ly9nb28lMjAlMjBnb28lN0MlN0Mu Y29tLy4gV2FzIGh0dHA6Ly9Hb28lMjAgZ29vJTdDfC5jb20vLgogRkFJTCBjYW5vbmljYWxpemUo J2h0dHA6Ly9HT0/CoOOAgGdvby5jb20vJykgc2hvdWxkIGJlIGh0dHA6Ly9nb28lMjAlMjBnb28u Y29tLy4gV2FzIGh0dHA6Ly9nb28gIGdvby5jb20vLgogUEFTUyBjYW5vbmljYWxpemUoJ2h0dHA6 Ly9HT0/igIvigaDvu79nb28uY29tLycpIGlzICdodHRwOi8vZ29vZ29vLmNvbS8nCkBAIC0yMiw3 ICsyMiw3IEBAIFBBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vJTI1LycpIGlzICdodHRwOi8vJTI1 LycKIFBBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vaGVsbG8lMDAvJykgaXMgJ2h0dHA6Ly9oZWxs byUwMC8nCiBGQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovLyUzMCU3OCU2MyUzMCUyZSUzMCUzMiUz NSUzMC4wMS8nKSBzaG91bGQgYmUgaHR0cDovLzE5Mi4xNjguMC4xLy4gV2FzIGh0dHA6Ly8lMzAl NzglNjMlMzAlMmUlMzAlMzIlMzUlMzAuMDEvLgogRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly8l MzAlNzglNjMlMzAlMmUlMzAlMzIlMzUlMzAuMDElMmUvJykgc2hvdWxkIGJlIGh0dHA6Ly8xOTIu MTY4LjAuMS8uIFdhcyBodHRwOi8vJTMwJTc4JTYzJTMwJTJlJTMwJTMyJTM1JTMwLjAxJTJlLy4K LUZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vJTNnJTc4JTYzJTMwJTJlJTMwJTMyJTM1JTMwJTJF LjAxLycpIHNob3VsZCBiZSBodHRwOi8vJTI1M2d4YzAuMDI1MC4uMDEvLiBXYXMgaHR0cDovLyUz ZyU3OCU2MyUzMCUyZSUzMCUzMiUzNSUzMCUyRS4wMS8uCitGQUlMIGNhbm9uaWNhbGl6ZSgnaHR0 cDovLyUzZyU3OCU2MyUzMCUyZSUzMCUzMiUzNSUzMCUyRS4wMS8nKSBzaG91bGQgYmUgaHR0cDov LyUyNTNneGMwLjAyNTAuLjAxLy4gV2FzIGh0dHA6Ly8lM2clNzglNjMlMzAlMmUlMzAlMzIlMzUl MzAlMmUuMDEvLgogRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly8xOTIuMTY4LjAuMSBoZWxsby8n KSBzaG91bGQgYmUgaHR0cDovLzE5Mi4xNjguMC4xJTIwaGVsbG8vLiBXYXMgaHR0cDovLzE5Mi4x NjguMC4xIGhlbGxvLy4KIEZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8v77yQ77y4772D77yQ77yO 77yQ77yS77yV77yQ77yO77yQ77yRLycpIHNob3VsZCBiZSBodHRwOi8vMTkyLjE2OC4wLjEvLiBX YXMgaHR0cDovLzB4YzAuMDI1MC4wMS8uCiBQQVNTIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzE5Mi4x NjguMC4yNTcvJykgaXMgJ2h0dHA6Ly8xOTIuMTY4LjAuMjU3LycKZGlmZiAtLWdpdCBhL0xheW91 dFRlc3RzL2Zhc3QvdXJsL2lwdjQtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC91cmwv aXB2NC1leHBlY3RlZC50eHQKaW5kZXggNDczZThiM2NhZmI4MDkxYzg1ODgyM2Q4MWFmNTQ3Y2Ux MmY3ODBmMy4uMGViYmMyNzE5M2MyOTg4NDQzNDc1M2FhMmZhM2ZmODA2NjA4NjNjNiAxMDA2NDQK LS0tIGEvTGF5b3V0VGVzdHMvZmFzdC91cmwvaXB2NC1leHBlY3RlZC50eHQKKysrIGIvTGF5b3V0 VGVzdHMvZmFzdC91cmwvaXB2NC1leHBlY3RlZC50eHQKQEAgLTcsMTcgKzcsMTcgQEAgRkFJTCBj YW5vbmljYWxpemUoJ2h0dHA6Ly8vJykgc2hvdWxkIGJlIGh0dHA6LiBXYXMgaHR0cDovLgogUEFT UyBjYW5vbmljYWxpemUoJ2h0dHA6Ly8uLycpIGlzICdodHRwOi8vLi8nCiBQQVNTIGNhbm9uaWNh bGl6ZSgnaHR0cDovLzE5Mi4xNjguMC4xLycpIGlzICdodHRwOi8vMTkyLjE2OC4wLjEvJwogRkFJ TCBjYW5vbmljYWxpemUoJ2h0dHA6Ly8wMzAwLjAyNTAuMDAuMDEvJykgc2hvdWxkIGJlIGh0dHA6 Ly8xOTIuMTY4LjAuMS8uIFdhcyBodHRwOi8vMDMwMC4wMjUwLjAwLjAxLy4KLUZBSUwgY2Fub25p Y2FsaXplKCdodHRwOi8vMHhDMC4wWGE4LjB4MC4weDEvJykgc2hvdWxkIGJlIGh0dHA6Ly8xOTIu MTY4LjAuMS8uIFdhcyBodHRwOi8vMHhDMC4wWGE4LjB4MC4weDEvLgorRkFJTCBjYW5vbmljYWxp emUoJ2h0dHA6Ly8weEMwLjBYYTguMHgwLjB4MS8nKSBzaG91bGQgYmUgaHR0cDovLzE5Mi4xNjgu MC4xLy4gV2FzIGh0dHA6Ly8weGMwLjB4YTguMHgwLjB4MS8uCiBQQVNTIGNhbm9uaWNhbGl6ZSgn aHR0cDovLzE5Mi4xNjguOS5jb20vJykgaXMgJ2h0dHA6Ly8xOTIuMTY4LjkuY29tLycKIFBBU1Mg Y2Fub25pY2FsaXplKCdodHRwOi8vMTlhLjE2OC4wLjEvJykgaXMgJ2h0dHA6Ly8xOWEuMTY4LjAu MS8nCiBQQVNTIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzAzMDguMDI1MC4wMC4wMS8nKSBpcyAnaHR0 cDovLzAzMDguMDI1MC4wMC4wMS8nCi1GQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzB4Q0cuMHhB OC4weDAuMHgxLycpIHNob3VsZCBiZSBodHRwOi8vMHhjZy4weGE4LjB4MC4weDEvLiBXYXMgaHR0 cDovLzB4Q0cuMHhBOC4weDAuMHgxLy4KK1BBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vMHhDRy4w eEE4LjB4MC4weDEvJykgaXMgJ2h0dHA6Ly8weGNnLjB4YTguMHgwLjB4MS8nCiBGQUlMIGNhbm9u aWNhbGl6ZSgnaHR0cDovLzE5Mi8nKSBzaG91bGQgYmUgaHR0cDovLzAuMC4wLjE5Mi8uIFdhcyBo dHRwOi8vMTkyLy4KLUZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vMHhDMGE4MDAwMS8nKSBzaG91 bGQgYmUgaHR0cDovLzE5Mi4xNjguMC4xLy4gV2FzIGh0dHA6Ly8weEMwYTgwMDAxLy4KK0ZBSUwg Y2Fub25pY2FsaXplKCdodHRwOi8vMHhDMGE4MDAwMS8nKSBzaG91bGQgYmUgaHR0cDovLzE5Mi4x NjguMC4xLy4gV2FzIGh0dHA6Ly8weGMwYTgwMDAxLy4KIEZBSUwgY2Fub25pY2FsaXplKCdodHRw Oi8vMDMwMDUyMDAwMDAxLycpIHNob3VsZCBiZSBodHRwOi8vMTkyLjE2OC4wLjEvLiBXYXMgaHR0 cDovLzAzMDA1MjAwMDAwMS8uCiBGQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzAwMDAzMDA1MjAw MDAwMS8nKSBzaG91bGQgYmUgaHR0cDovLzE5Mi4xNjguMC4xLy4gV2FzIGh0dHA6Ly8wMDAwMzAw NTIwMDAwMDEvLgogRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly8xOTIuMTY4LycpIHNob3VsZCBi ZSBodHRwOi8vMTkyLjAuMC4xNjgvLiBXYXMgaHR0cDovLzE5Mi4xNjgvLgotRkFJTCBjYW5vbmlj YWxpemUoJ2h0dHA6Ly8xOTIuMHgwMEE4MDAwMS8nKSBzaG91bGQgYmUgaHR0cDovLzE5Mi4xNjgu MC4xLy4gV2FzIGh0dHA6Ly8xOTIuMHgwMEE4MDAwMS8uCitGQUlMIGNhbm9uaWNhbGl6ZSgnaHR0 cDovLzE5Mi4weDAwQTgwMDAxLycpIHNob3VsZCBiZSBodHRwOi8vMTkyLjE2OC4wLjEvLiBXYXMg aHR0cDovLzE5Mi4weDAwYTgwMDAxLy4KIEZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vMHhjMC4w NTIwMDAwMDEvJykgc2hvdWxkIGJlIGh0dHA6Ly8xOTIuMTY4LjAuMS8uIFdhcyBodHRwOi8vMHhj MC4wNTIwMDAwMDEvLgogRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly8xOTIuMTY4LjEvJykgc2hv dWxkIGJlIGh0dHA6Ly8xOTIuMTY4LjAuMS8uIFdhcyBodHRwOi8vMTkyLjE2OC4xLy4KIFBBU1Mg Y2Fub25pY2FsaXplKCdodHRwOi8vMTkyLjE2OC4wLjAuMS8nKSBpcyAnaHR0cDovLzE5Mi4xNjgu MC4wLjEvJwpAQCAtMzQsMjQgKzM0LDI0IEBAIFBBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vMC4w LjAuMHgxMDAvJykgaXMgJ2h0dHA6Ly8wLjAuMC4weDEwMC8nCiBQQVNTIGNhbm9uaWNhbGl6ZSgn aHR0cDovLzAuMC4weDEwMDAwLycpIGlzICdodHRwOi8vMC4wLjB4MTAwMDAvJwogUEFTUyBjYW5v bmljYWxpemUoJ2h0dHA6Ly8wLjB4MTAwMDAwMC8nKSBpcyAnaHR0cDovLzAuMHgxMDAwMDAwLycK IFBBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vMHgxMDAwMDAwMDAvJykgaXMgJ2h0dHA6Ly8weDEw MDAwMDAwMC8nCi1GQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzB4RkYuMC8nKSBzaG91bGQgYmUg aHR0cDovLzI1NS4wLjAuMC8uIFdhcyBodHRwOi8vMHhGRi4wLy4KLUZBSUwgY2Fub25pY2FsaXpl KCdodHRwOi8vMHhGRi4wLjAvJykgc2hvdWxkIGJlIGh0dHA6Ly8yNTUuMC4wLjAvLiBXYXMgaHR0 cDovLzB4RkYuMC4wLy4KLUZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vMHhGRi4wLjAuMC8nKSBz aG91bGQgYmUgaHR0cDovLzI1NS4wLjAuMC8uIFdhcyBodHRwOi8vMHhGRi4wLjAuMC8uCi1GQUlM IGNhbm9uaWNhbGl6ZSgnaHR0cDovLzAuMHhGRi4wLjAvJykgc2hvdWxkIGJlIGh0dHA6Ly8wLjI1 NS4wLjAvLiBXYXMgaHR0cDovLzAuMHhGRi4wLjAvLgotRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6 Ly8wLjAuMHhGRi4wLycpIHNob3VsZCBiZSBodHRwOi8vMC4wLjI1NS4wLy4gV2FzIGh0dHA6Ly8w LjAuMHhGRi4wLy4KLUZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vMC4wLjAuMHhGRi8nKSBzaG91 bGQgYmUgaHR0cDovLzAuMC4wLjI1NS8uIFdhcyBodHRwOi8vMC4wLjAuMHhGRi8uCi1GQUlMIGNh bm9uaWNhbGl6ZSgnaHR0cDovLzAuMC4weEZGRkYvJykgc2hvdWxkIGJlIGh0dHA6Ly8wLjAuMjU1 LjI1NS8uIFdhcyBodHRwOi8vMC4wLjB4RkZGRi8uCi1GQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDov LzAuMHhGRkZGRkYvJykgc2hvdWxkIGJlIGh0dHA6Ly8wLjI1NS4yNTUuMjU1Ly4gV2FzIGh0dHA6 Ly8wLjB4RkZGRkZGLy4KLUZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vMHhGRkZGRkZGRi8nKSBz aG91bGQgYmUgaHR0cDovLzI1NS4yNTUuMjU1LjI1NS8uIFdhcyBodHRwOi8vMHhGRkZGRkZGRi8u CitGQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzB4RkYuMC8nKSBzaG91bGQgYmUgaHR0cDovLzI1 NS4wLjAuMC8uIFdhcyBodHRwOi8vMHhmZi4wLy4KK0ZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8v MHhGRi4wLjAvJykgc2hvdWxkIGJlIGh0dHA6Ly8yNTUuMC4wLjAvLiBXYXMgaHR0cDovLzB4ZmYu MC4wLy4KK0ZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vMHhGRi4wLjAuMC8nKSBzaG91bGQgYmUg aHR0cDovLzI1NS4wLjAuMC8uIFdhcyBodHRwOi8vMHhmZi4wLjAuMC8uCitGQUlMIGNhbm9uaWNh bGl6ZSgnaHR0cDovLzAuMHhGRi4wLjAvJykgc2hvdWxkIGJlIGh0dHA6Ly8wLjI1NS4wLjAvLiBX YXMgaHR0cDovLzAuMHhmZi4wLjAvLgorRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly8wLjAuMHhG Ri4wLycpIHNob3VsZCBiZSBodHRwOi8vMC4wLjI1NS4wLy4gV2FzIGh0dHA6Ly8wLjAuMHhmZi4w Ly4KK0ZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vMC4wLjAuMHhGRi8nKSBzaG91bGQgYmUgaHR0 cDovLzAuMC4wLjI1NS8uIFdhcyBodHRwOi8vMC4wLjAuMHhmZi8uCitGQUlMIGNhbm9uaWNhbGl6 ZSgnaHR0cDovLzAuMC4weEZGRkYvJykgc2hvdWxkIGJlIGh0dHA6Ly8wLjAuMjU1LjI1NS8uIFdh cyBodHRwOi8vMC4wLjB4ZmZmZi8uCitGQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzAuMHhGRkZG RkYvJykgc2hvdWxkIGJlIGh0dHA6Ly8wLjI1NS4yNTUuMjU1Ly4gV2FzIGh0dHA6Ly8wLjB4ZmZm ZmZmLy4KK0ZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vMHhGRkZGRkZGRi8nKSBzaG91bGQgYmUg aHR0cDovLzI1NS4yNTUuMjU1LjI1NS8uIFdhcyBodHRwOi8vMHhmZmZmZmZmZi8uCiBQQVNTIGNh bm9uaWNhbGl6ZSgnaHR0cDovLzI3Ni4yNTYuMHhmMWEyLjA3Nzc3Ny8nKSBpcyAnaHR0cDovLzI3 Ni4yNTYuMHhmMWEyLjA3Nzc3Ny8nCiBQQVNTIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzE5Mi4xNjgu MC4yNTcvJykgaXMgJ2h0dHA6Ly8xOTIuMTY4LjAuMjU3LycKIFBBU1MgY2Fub25pY2FsaXplKCdo dHRwOi8vMTkyLjE2OC4weGEyMDAwMS8nKSBpcyAnaHR0cDovLzE5Mi4xNjguMHhhMjAwMDEvJwog UEFTUyBjYW5vbmljYWxpemUoJ2h0dHA6Ly8xOTIuMDE1MDUyMDAwMDAxLycpIGlzICdodHRwOi8v MTkyLjAxNTA1MjAwMDAwMS8nCi1GQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzBYMTJDMGE4MDAw MS8nKSBzaG91bGQgYmUgaHR0cDovLzB4MTJjMGE4MDAwMS8uIFdhcyBodHRwOi8vMFgxMkMwYTgw MDAxLy4KK1BBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vMFgxMkMwYTgwMDAxLycpIGlzICdodHRw Oi8vMHgxMmMwYTgwMDAxLycKIFBBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vMjc2LjEuMi8nKSBp cyAnaHR0cDovLzI3Ni4xLjIvJwogRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly8xOTIuMTY4LjAu MSBoZWxsby8nKSBzaG91bGQgYmUgaHR0cDovLzE5Mi4xNjguMC4xJTIwaGVsbG8vLiBXYXMgaHR0 cDovLzE5Mi4xNjguMC4xIGhlbGxvLy4KLUZBSUwgY2Fub25pY2FsaXplKCdodHRwOi8vMDAwMDAw MDAwMDAwMDMwMC4weDAwMDAwMDAwMDAwMDAwZkYuMDAwMDAwMDAwMDAwMDAwMDEvJykgc2hvdWxk IGJlIGh0dHA6Ly8xOTIuMjU1LjAuMS8uIFdhcyBodHRwOi8vMDAwMDAwMDAwMDAwMDMwMC4weDAw MDAwMDAwMDAwMDAwZkYuMDAwMDAwMDAwMDAwMDAwMDEvLgotRkFJTCBjYW5vbmljYWxpemUoJ2h0 dHA6Ly8wMDAwMDAwMDAwMDAwMzAwLjB4ZmZmZmZmZmZGRkZGRkZGRi4zMDIyNDE1NDgxNDcwOTc3 LycpIHNob3VsZCBiZSBodHRwOi8vMDAwMDAwMDAwMDAwMDMwMC4weGZmZmZmZmZmZmZmZmZmZmYu MzAyMjQxNTQ4MTQ3MDk3Ny8uIFdhcyBodHRwOi8vMDAwMDAwMDAwMDAwMDMwMC4weGZmZmZmZmZm RkZGRkZGRkYuMzAyMjQxNTQ4MTQ3MDk3Ny8uCitGQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzAw MDAwMDAwMDAwMDAzMDAuMHgwMDAwMDAwMDAwMDAwMGZGLjAwMDAwMDAwMDAwMDAwMDAxLycpIHNo b3VsZCBiZSBodHRwOi8vMTkyLjI1NS4wLjEvLiBXYXMgaHR0cDovLzAwMDAwMDAwMDAwMDAzMDAu MHgwMDAwMDAwMDAwMDAwMGZmLjAwMDAwMDAwMDAwMDAwMDAxLy4KK1BBU1MgY2Fub25pY2FsaXpl KCdodHRwOi8vMDAwMDAwMDAwMDAwMDMwMC4weGZmZmZmZmZmRkZGRkZGRkYuMzAyMjQxNTQ4MTQ3 MDk3Ny8nKSBpcyAnaHR0cDovLzAwMDAwMDAwMDAwMDAzMDAuMHhmZmZmZmZmZmZmZmZmZmZmLjMw MjI0MTU0ODE0NzA5NzcvJwogRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly8wMDAwMDAwMDAwMDAw MDAwMDAwMS8nKSBzaG91bGQgYmUgaHR0cDovLzAuMC4wLjEvLiBXYXMgaHR0cDovLzAwMDAwMDAw MDAwMDAwMDAwMDAxLy4KIFBBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vMDAwMDAwMDAwMDAwMDAw MDEwMDAwMDAwMDAwMDAwMDAwMS8nKSBpcyAnaHR0cDovLzAwMDAwMDAwMDAwMDAwMDAxMDAwMDAw MDAwMDAwMDAwMDEvJwogUEFTUyBjYW5vbmljYWxpemUoJ2h0dHA6Ly8wLjAuMC4wMDAwMDAwMDAw MDAwMDAwMDB6LycpIGlzICdodHRwOi8vMC4wLjAuMDAwMDAwMDAwMDAwMDAwMDAwei8nCmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L3VybC9pcHY2LWV4cGVjdGVkLnR4dCBiL0xheW91dFRl c3RzL2Zhc3QvdXJsL2lwdjYtZXhwZWN0ZWQudHh0CmluZGV4IGE3MzE5ZGU5YjFmYjgwZDZhODhk YzA0ZGI2MmQ4MjY2MzUyYTk3N2YuLmFmZGZiNDI5MzZkOTNkNTI4NzM4N2UwM2E5Y2YzMmMxODA4 ZmIyOTMgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL2Zhc3QvdXJsL2lwdjYtZXhwZWN0ZWQudHh0 CisrKyBiL0xheW91dFRlc3RzL2Zhc3QvdXJsL2lwdjYtZXhwZWN0ZWQudHh0CkBAIC0xOSw3ICsx OSw3IEBAIFBBU1MgY2Fub25pY2FsaXplKCdodHRwOi8vWzE6Ol0vJykgaXMgJ2h0dHA6Ly9bMTo6 XS8nCiBGQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovL1s6OjE5Mi4xNjguMC4xXS8nKSBzaG91bGQg YmUgaHR0cDovL1s6OmMwYTg6MV0vLiBXYXMgaHR0cDovL1s6OjE5Mi4xNjguMC4xXS8uCiBGQUlM IGNhbm9uaWNhbGl6ZSgnaHR0cDovL1s6OmZmZmY6MTkyLjE2OC4wLjFdLycpIHNob3VsZCBiZSBo dHRwOi8vWzo6ZmZmZjpjMGE4OjFdLy4gV2FzIGh0dHA6Ly9bOjpmZmZmOjE5Mi4xNjguMC4xXS8u CiBGQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovL1swMDA6MDE6MDI6MDAzOjAwNDo1OjY6MDA3XS8n KSBzaG91bGQgYmUgaHR0cDovL1swOjE6MjozOjQ6NTo2OjddLy4gV2FzIGh0dHA6Ly9bMDAwOjAx OjAyOjAwMzowMDQ6NTo2OjAwN10vLgotRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly9bQTpiOmM6 REU6ZkY6MDoxOmFDXS8nKSBzaG91bGQgYmUgaHR0cDovL1thOmI6YzpkZTpmZjowOjE6YWNdLy4g V2FzIGh0dHA6Ly9bQTpiOmM6REU6ZkY6MDoxOmFDXS8uCitQQVNTIGNhbm9uaWNhbGl6ZSgnaHR0 cDovL1tBOmI6YzpERTpmRjowOjE6YUNdLycpIGlzICdodHRwOi8vW2E6YjpjOmRlOmZmOjA6MTph Y10vJwogRkFJTCBjYW5vbmljYWxpemUoJ2h0dHA6Ly9bMTowOjA6Mjo6MzowXS8nKSBzaG91bGQg YmUgaHR0cDovL1sxOjoyOjA6MDozOjBdLy4gV2FzIGh0dHA6Ly9bMTowOjA6Mjo6MzowXS8uCiBQ QVNTIGNhbm9uaWNhbGl6ZSgnaHR0cDovL1sxOjoyOjA6MDozOjBdLycpIGlzICdodHRwOi8vWzE6 OjI6MDowOjM6MF0vJwogUEFTUyBjYW5vbmljYWxpemUoJ2h0dHA6Ly9bOjplZWVlOjE5Mi4xNjgu MC4xXS8nKSBpcyAnaHR0cDovL1s6OmVlZWU6MTkyLjE2OC4wLjFdLycKZGlmZiAtLWdpdCBhL0xh eW91dFRlc3RzL2Zhc3QvdXJsL3JlbGF0aXZlLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zh c3QvdXJsL3JlbGF0aXZlLWV4cGVjdGVkLnR4dAppbmRleCA4ZWU3ODFjMGFhMzI2ZTQ2NGViOGM5 YTA0MDU4MTM4Mzk4NDY5MmEwLi4yZTE4MDdiYTVlZGMzZGQ5N2RhYzlkNmZiZDZhZjU2MzIyYzdm NmZlIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9mYXN0L3VybC9yZWxhdGl2ZS1leHBlY3RlZC50 eHQKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC91cmwvcmVsYXRpdmUtZXhwZWN0ZWQudHh0CkBAIC01 MywxMCArNTMsMTAgQEAgUEFTUyBjYW5vbmljYWxpemUoJzsvLi4vYmFyJykgaXMgJ2h0dHA6Ly9o b3N0L2JhcicKIFBBU1MgY2Fub25pY2FsaXplKCcvL2Fub3RoZXInKSBpcyAnaHR0cDovL2Fub3Ro ZXIvJwogUEFTUyBjYW5vbmljYWxpemUoJy8vYW5vdGhlci9wYXRoP3F1ZXJ5I3JlZicpIGlzICdo dHRwOi8vYW5vdGhlci9wYXRoP3F1ZXJ5I3JlZicKIEZBSUwgY2Fub25pY2FsaXplKCcvLy9hbm90 aGVyL3BhdGgnKSBzaG91bGQgYmUgaHR0cDovL2Fub3RoZXIvcGF0aC4gV2FzIGh0dHA6L2Fub3Ro ZXIvcGF0aC4KLUZBSUwgY2Fub25pY2FsaXplKCcvL0Fub3RoZXJcXHBhdGgnKSBzaG91bGQgYmUg aHR0cDovL2Fub3RoZXIvcGF0aC4gV2FzIGh0dHA6Ly9Bbm90aGVyL3BhdGguCitQQVNTIGNhbm9u aWNhbGl6ZSgnLy9Bbm90aGVyXFxwYXRoJykgaXMgJ2h0dHA6Ly9hbm90aGVyL3BhdGgnCiBGQUlM IGNhbm9uaWNhbGl6ZSgnLy8nKSBzaG91bGQgYmUgaHR0cDouIFdhcyBodHRwOi8uCiBQQVNTIGNh bm9uaWNhbGl6ZSgnXFwvYW5vdGhlci9wYXRoJykgaXMgJ2h0dHA6Ly9hbm90aGVyL3BhdGgnCi1G QUlMIGNhbm9uaWNhbGl6ZSgnL1xcQW5vdGhlclxccGF0aCcpIHNob3VsZCBiZSBodHRwOi8vYW5v dGhlci9wYXRoLiBXYXMgaHR0cDovL0Fub3RoZXIvcGF0aC4KK1BBU1MgY2Fub25pY2FsaXplKCcv XFxBbm90aGVyXFxwYXRoJykgaXMgJ2h0dHA6Ly9hbm90aGVyL3BhdGgnCiBQQVNTIHN1Y2Nlc3Nm dWxseVBhcnNlZCBpcyB0cnVlCiAKIFRFU1QgQ09NUExFVEUKZGlmZiAtLWdpdCBhL0xheW91dFRl c3RzL2Zhc3QvdXJsL3JlbGF0aXZlLXVuaXgtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFz dC91cmwvcmVsYXRpdmUtdW5peC1leHBlY3RlZC50eHQKaW5kZXggYWNkNTlhYjAyOGM5NGFiYzlh YWM2YTc4ZGMyMjgxZDI3MTJmOWUwMy4uNGNmY2RhMDE3MTMxNjQzNzM1ZTAyM2E2ZTAwZjc2Mjg4 MzFkZmNjMSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvZmFzdC91cmwvcmVsYXRpdmUtdW5peC1l eHBlY3RlZC50eHQKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC91cmwvcmVsYXRpdmUtdW5peC1leHBl Y3RlZC50eHQKQEAgLTMsNyArMyw3IEBAIFRlc3QgcmVzb2x1dGlvbiBvZiByZWxhdGl2ZSBVTklY LWxpa2UgVVJMcy4KIE9uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIg bWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KIAogCi1GQUlMIGNhbm9uaWNh bGl6ZSgnXFxcXEFub3RoZXJcXHBhdGgnKSBzaG91bGQgYmUgaHR0cDovL2Fub3RoZXIvcGF0aC4g V2FzIGh0dHA6Ly9Bbm90aGVyL3BhdGguCitQQVNTIGNhbm9uaWNhbGl6ZSgnXFxcXEFub3RoZXJc XHBhdGgnKSBpcyAnaHR0cDovL2Fub3RoZXIvcGF0aCcKIFBBU1MgY2Fub25pY2FsaXplKCcvYzpc XGZvbycpIGlzICdodHRwOi8vaG9zdC9jOi9mb28nCiBGQUlMIGNhbm9uaWNhbGl6ZSgnLy9jOlxc Zm9vJykgc2hvdWxkIGJlIGh0dHA6Ly9jL2Zvby4gV2FzIGh0dHA6Ly9jOi9mb28uCiBQQVNTIHN1 Y2Nlc3NmdWxseVBhcnNlZCBpcyB0cnVlCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L3Vy bC9zdGFuZGFyZC11cmwtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC91cmwvc3RhbmRh cmQtdXJsLWV4cGVjdGVkLnR4dAppbmRleCAxOGE1MTE3NGZhMGIxNjFkY2I5MDEyYzIzYWU0NTA2 Y2FlOWM2NzBjLi4zZjUxN2Q0YWIzY2FkNmZkZmMwYmIzYzI2M2VkYmNmM2RhNmY5OWNiIDEwMDY0 NAotLS0gYS9MYXlvdXRUZXN0cy9mYXN0L3VybC9zdGFuZGFyZC11cmwtZXhwZWN0ZWQudHh0Cisr KyBiL0xheW91dFRlc3RzL2Zhc3QvdXJsL3N0YW5kYXJkLXVybC1leHBlY3RlZC50eHQKQEAgLTYs NyArNiw3IEBAIE9uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIgbWVz c2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFCiBQQVNTIGNhbm9uaWNhbGl6ZSgnaHR0 cDovL3d3dy5nb29nbGUuY29tL2Zvbz9iYXI9YmF6IycpIGlzICdodHRwOi8vd3d3Lmdvb2dsZS5j b20vZm9vP2Jhcj1iYXojJwogUEFTUyBjYW5vbmljYWxpemUoJ2h0dHA6Ly9bd3d3Lmdvb2dsZS5j b21dLycpIGlzICdodHRwOi8vW3d3dy5nb29nbGUuY29tXS8nCiBGQUlMIGNhbm9uaWNhbGl6ZSgn aHR0cDovLy8vLy8vL3VzZXI6QGdvb2dsZS5jb206OTk/Zm9vJykgc2hvdWxkIGJlIGh0dHA6Ly91 c2VyQGdvb2dsZS5jb206OTkvP2Zvby4gV2FzIGh0dHA6Ly8vLy8vdXNlcjpAZ29vZ2xlLmNvbTo5 OT9mb28uCi1GQUlMIGNhbm9uaWNhbGl6ZSgnaHR0cDovLzE5Mi4weDAwQTgwMDAxJykgc2hvdWxk IGJlIGh0dHA6Ly8xOTIuMTY4LjAuMS8uIFdhcyBodHRwOi8vMTkyLjB4MDBBODAwMDEvLgorRkFJ TCBjYW5vbmljYWxpemUoJ2h0dHA6Ly8xOTIuMHgwMEE4MDAwMScpIHNob3VsZCBiZSBodHRwOi8v MTkyLjE2OC4wLjEvLiBXYXMgaHR0cDovLzE5Mi4weDAwYTgwMDAxLy4KIEZBSUwgY2Fub25pY2Fs aXplKCdodHRwOi8vd3d3L2ZvbyUyRWh0bWwnKSBzaG91bGQgYmUgaHR0cDovL3d3dy9mb28uaHRt bC4gV2FzIGh0dHA6Ly93d3cvZm9vJTJFaHRtbC4KIFBBU1MgY2Fub25pY2FsaXplKCdodHRwOi8v dXNlcjpwYXNzQC8nKSBpcyAnaHR0cDovL3VzZXI6cGFzc0AvJwogUEFTUyBjYW5vbmljYWxpemUo J2h0dHA6Ly8lMjVET01BSU46Zm9vYmFyQGZvb2RvbWFpbi5jb20vJykgaXMgJ2h0dHA6Ly8lMjVE T01BSU46Zm9vYmFyQGZvb2RvbWFpbi5jb20vJwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUv Q2hhbmdlTG9nIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IGQ0NDc1ZTI1YmVkMzA1 MzAwOWY3MDllMzA5NWNmOWI2YTA5MWExOWUuLmE4NmIwMWI2N2M3ZWJiMTMwZmM5YWE5NDIzY2Fl YjVlOWY3YTJlMTIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9T b3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAxMS0wMi0wOSAgRXJp YyBTZWlkZWwgIDxlcmljQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgSG9zdG5hbWVzIHNob3VsZCBjYW5ub25pY2FsaXplIHRvIGxv d2VyY2FzZSAodG8gbWF0Y2ggZXZlcnkgb3RoZXIgYnJvd3NlcikKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU0MDg0CisKKyAgICAgICAgKiBwbGF0Zm9y bS9LVVJMLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OktVUkw6OnBhcnNlKToKKwogMjAxMS0wMi0w OCAgUGF2ZWwgUG9kaXZpbG92ICA8cG9kaXZpbG92QGNocm9taXVtLm9yZz4KIAogICAgICAgICBS ZXZpZXdlZCBieSBQYXZlbCBGZWxkbWFuLgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGxh dGZvcm0vS1VSTC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9LVVJMLmNwcAppbmRleCAz NWE0OGU5YWQ0ZGY1Y2QxNjA0ZTVmMmQxMjIxY2I5MDMzYjg5Y2M4Li45NDhkYjQ1YTg1YTUwN2Zk MzFlYmFiZjE2M2VjODhiNmUwNGFkMTEwIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wbGF0 Zm9ybS9LVVJMLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9LVVJMLmNwcApAQCAt MTMwMiw3ICsxMzAyLDcgQEAgdm9pZCBLVVJMOjpwYXJzZShjb25zdCBjaGFyKiB1cmwsIGNvbnN0 IFN0cmluZyogb3JpZ2luYWxTdHJpbmcpCiAgICAgICAgICAgICBzdHJQdHIgPSB1cmwgKyBob3N0 U3RhcnQ7CiAgICAgICAgICAgICBjb25zdCBjaGFyKiBob3N0RW5kUHRyID0gdXJsICsgaG9zdEVu ZDsKICAgICAgICAgICAgIHdoaWxlIChzdHJQdHIgPCBob3N0RW5kUHRyKQotICAgICAgICAgICAg ICAgICpwKysgPSAqc3RyUHRyKys7CisgICAgICAgICAgICAgICAgKnArKyA9IHRvQVNDSUlMb3dl cigqc3RyUHRyKyspOwogICAgICAgICB9CiAgICAgICAgIG1faG9zdEVuZCA9IHAgLSBidWZmZXIu ZGF0YSgpOwogCg==