54551 2011-02-16 06:39:35 -0800 disable execution of inline scripts when a content security policy is present 2011-05-11 01:33:31 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Other OS X 10.5 RESOLVED FIXED P2 Normal --- 53572 1 jochen jochen abarth eric ossy webkit-ews oldest_to_newest 352030 0 jochen 2011-02-16 06:39:35 -0800 disable execution of inline scripts when a content security policy is present 352031 1 82626 jochen 2011-02-16 06:40:06 -0800 Created attachment 82626 Patch 352034 2 jochen 2011-02-16 06:42:04 -0800 i'm starting to implement the cases of javascript that shouldn't get executed: here inline scripts (will make sure script tags created by scripts aren't executed either in a separate cl) 352038 3 webkit-ews 2011-02-16 06:53:32 -0800 Attachment 82626 did not build on qt: Build output: http://queues.webkit.org/results/7917359 352047 4 jochen 2011-02-16 07:13:57 -0800 seems like qt is at an old revision? 352137 5 ossy 2011-02-16 09:34:12 -0800 (In reply to comment #4) > seems like qt is at an old revision? Hmmmm .... Very strange ... Qt build works for me on trunk (r78709) AFAIK EWS always updates before testing a patch. I have no idea what caused this false alarm. Eric, any idea? 352163 6 82626 abarth 2011-02-16 10:13:36 -0800 Comment on attachment 82626 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=82626&action=review > Source/WebCore/html/parser/HTMLDocumentParser.cpp:468 > +bool HTMLDocumentParser::shouldRunInlineScripts() I see that you've patterned this after shouldLoadExternalScriptFromSrc, but shouldLoadExternalScriptFromSrc is very wrong. It's nowhere need near the only way to run external scripts. > Source/WebCore/html/parser/HTMLDocumentParser.h:110 > + virtual bool shouldRunInlineScripts(); This should be a method on ContentSecurityPolicy. ContentSecurityPolicy should encapsulate the semantics of the policy. I'd call it something like ContentSecurityPolicy::allowInlineScripts() > Source/WebCore/html/parser/HTMLScriptRunner.cpp:307 > + } else if (m_host->shouldRunInlineScripts()) { This is the wrong layer. We should do this work in ScriptController. We probably need to teach script controller some things it doesn't know yet. It's probably easier to do JavaScript URLs first because ScriptController has a pretty good handle on whether it's trying to execute a JavaScript URL. > Source/WebCore/page/ContentSecurityPolicy.h:42 > + bool hasPolicy() const { return m_havePolicy; } This should be private. 401845 7 abarth 2011-05-11 01:33:31 -0700 This got fixed in another bug. 82626 2011-02-16 06:40:06 -0800 2011-02-16 10:13:36 -0800 Patch bug-54551-20110216154002.patch text/plain 10713 jochen U3VidmVyc2lvbiBSZXZpc2lvbjogNzg3MDEKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBjZWE4ZWMxY2ZmNzU1MzU4NzI0Yjlm NzFkNGZkMmIxYzZlMjMxOTUxLi5mMjdjYWI0OGZlNWQ0OTNkZTk4ZTgwNzI4ODYwOGU1OGU0YTk4 YjllIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTEtMDItMTYgIEpvY2hlbiBFaXNpbmdlciAg PGpvY2hlbkBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgZGlzYWJsZSBleGVjdXRpb24gb2YgaW5saW5lIHNjcmlwdHMgd2hlbiBh IGNvbnRlbnQgc2VjdXJpdHkgcG9saWN5IGlzIHByZXNlbnQKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU0NTUxCisKKyAgICAgICAgKiBodHRwL3Rlc3Rz L3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9pbmxpbmUtc2NyaXB0LWV4cGVjdGVkLnR4 dDogQWRkZWQuCisgICAgICAgICogaHR0cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQ b2xpY3kvaW5saW5lLXNjcmlwdC5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBodHRwL3Rlc3RzL3Nl Y3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9uby1wb2xpY3ktZXhwZWN0ZWQudHh0OgorICAg ICAgICAqIGh0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L25vLXBvbGlj eS5odG1sOgorICAgICAgICAqIGh0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9s aWN5L3Jlc291cmNlcy9pbmxpbmUtc2NyaXB0LnBsOiBBZGRlZC4KKwogMjAxMS0wMi0xNiAgUGhp bGlwcGUgTm9ybWFuZCAgPHBub3JtYW5kQGlnYWxpYS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQg YnkgQWRhbSBSb2Jlbi4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJp dHkvY29udGVudFNlY3VyaXR5UG9saWN5L2lubGluZS1zY3JpcHQtZXhwZWN0ZWQudHh0IGIvTGF5 b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvaW5saW5l LXNjcmlwdC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uNWVmMjQ3OTFjNmNjMTFkODg5YmM4NTI3 ODRhM2ZiN2ZjMjM0YzUwZQotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2h0dHAvdGVz dHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L2lubGluZS1zY3JpcHQtZXhwZWN0ZWQu dHh0CkBAIC0wLDAgKzEsOCBAQAorTG9hZHMgYW4gaWZyYW1lIHdpdGggYSBjb250ZW50IHNlY3Vy aXR5IHBvbGljeSwgc28gaW5saW5lIHNjcmlwdHMgaW4gdGhpcyBpZnJhbWUgc2hvdWxkIG5vdCBi ZSBleGVjdXRlZC4KKworCisKKy0tLS0tLS0tCitGcmFtZTogJzwhLS1mcmFtZVBhdGggLy88IS0t ZnJhbWUwLS0+LS0+JworLS0tLS0tLS0KK1BBU1MKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0 dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L2lubGluZS1zY3JpcHQuaHRt bCBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5 L2lubGluZS1zY3JpcHQuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5mMTYxZjI2ZDE1MDI0MmE0NmJiYzQ3ZjFm ZTMyZWRlNTRhN2RiNjViCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0 cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvaW5saW5lLXNjcmlwdC5odG1sCkBAIC0w LDAgKzEsMTcgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQ+Citp ZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKSB7CisgIGxheW91dFRlc3RDb250cm9sbGVy LmR1bXBBc1RleHQoKTsKKyAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcENoaWxkRnJhbWVzQXNU ZXh0KCk7Cit9Cis8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5PgorICA8cD4KKyAgICBMb2FkcyBh biBpZnJhbWUgd2l0aCBhIGNvbnRlbnQgc2VjdXJpdHkgcG9saWN5LCBzbyBpbmxpbmUgc2NyaXB0 cyBpbiB0aGlzIGlmcmFtZSBzaG91bGQgbm90IGJlIGV4ZWN1dGVkLgorICA8L3A+CisgIDxpZnJh bWUgc3JjPSJodHRwOi8vMTI3LjAuMC4xOjgwMDAvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9s aWN5L3Jlc291cmNlcy9pbmxpbmUtc2NyaXB0LnBsIj48L2lmcmFtZT4KKzwvYm9keT4KKzwvaHRt bD4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNl Y3VyaXR5UG9saWN5L25vLXBvbGljeS1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9odHRwL3Rl c3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9uby1wb2xpY3ktZXhwZWN0ZWQudHh0 CmluZGV4IDJmMThlNzMxZTVmOTkwZTY1OTdmZjQxNmViYTQ3YWFiMWIzMGU1NWMuLjViNzlkNjhi YWU5MmVjYmFmNmVhZDhjNjczMmMyMTU2ZDliYTUyNDcgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3Rz L2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L25vLXBvbGljeS1leHBl Y3RlZC50eHQKKysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2Vj dXJpdHlQb2xpY3kvbm8tcG9saWN5LWV4cGVjdGVkLnR4dApAQCAtMSwzICsxLDYgQEAKIExvYWRz IGFuIGV4dGVybmFsIHNjcmlwdC4gU2luY2Ugbm8gY29udGVudCBzZWN1cml0eSBwb2xpY3kgaXMg cHJlc2VudCwgdGhlIHNjcmlwdCBzaG91bGQgZ2V0IGV4ZWN1dGVkLgogCiBQQVNTCitGdXJ0aGVy bW9yZSwgaW5saW5lIHNjcmlwdHMgc2hvdWxkIGdldCBleGVjdXRlZC4KKworUEFTUwpkaWZmIC0t Z2l0IGEvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xp Y3kvbm8tcG9saWN5Lmh0bWwgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRl bnRTZWN1cml0eVBvbGljeS9uby1wb2xpY3kuaHRtbAppbmRleCA0YTcxNDk3MDY2Y2E4YmFjYThm ZGZmYzZiZDcxODZlNDczNTNkODFlLi5hOGE0ZDZkOTIzYWNkM2VjNmVmNzlhNWIwMzBlYWY4ODc0 Zjk0YmQxIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRl bnRTZWN1cml0eVBvbGljeS9uby1wb2xpY3kuaHRtbAorKysgYi9MYXlvdXRUZXN0cy9odHRwL3Rl c3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9uby1wb2xpY3kuaHRtbApAQCAtMTQs NSArMTQsMTUgQEAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKICAgICBGQUlMCiAg IDwvZGl2PgogICA8c2NyaXB0IHNyYz0iaHR0cDovLzEyNy4wLjAuMTo4MDAwL3NlY3VyaXR5L2Nv bnRlbnRTZWN1cml0eVBvbGljeS9yZXNvdXJjZXMvc2NyaXB0LmpzIj48L3NjcmlwdD4KKyAgPHA+ CisgICAgRnVydGhlcm1vcmUsIGlubGluZSBzY3JpcHRzIHNob3VsZCBnZXQgZXhlY3V0ZWQuCisg IDwvcD4KKyAgPGRpdiBpZD0iaW5saW5lLXJlc3VsdCI+CisgICAgRkFJTAorICA8L2Rpdj4KKyAg PHNjcmlwdD4KKyAgICB2YXIgcmVzdWx0ID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImlubGlu ZS1yZXN1bHQiKTsKKyAgICByZXN1bHQuZmlyc3RDaGlsZC5ub2RlVmFsdWUgPSAiUEFTUyI7Cisg IDwvc2NyaXB0PgogPC9ib2R5PgogPC9odG1sPgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvaHR0 cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvcmVzb3VyY2VzL2lubGluZS1z Y3JpcHQucGwgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0 eVBvbGljeS9yZXNvdXJjZXMvaW5saW5lLXNjcmlwdC5wbApuZXcgZmlsZSBtb2RlIDEwMDc1NQpp bmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5jMGJlOWU4ZTY4 NGZkODc3ODQ5YjczYmM2ZDRjMTc0Mzk4ZmEyYWZmCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0 VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvcmVzb3VyY2Vz L2lubGluZS1zY3JpcHQucGwKQEAgLTAsMCArMSwyMSBAQAorIyEvdXNyL2Jpbi9wZXJsIC13VAor dXNlIHN0cmljdDsKK3VzZSBDR0k7CisKK215ICRjZ2kgPSBuZXcgQ0dJOworCitwcmludCAiQ29u dGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLThcbiI7CitwcmludCAiWC1XZWJLaXQt Q1NQOiBhbGxvdyAqXG5cbiI7CisKK3ByaW50ICI8IURPQ1RZUEUgaHRtbD5cbiI7CitwcmludCAi PGh0bWw+XG4iOworcHJpbnQgIjxib2R5PlxuIjsKK3ByaW50ICI8ZGl2IGlkPVwicmVzdWx0XCI+ XG4iOworcHJpbnQgIlBBU1NcbiI7CitwcmludCAiPC9kaXY+XG4iOworcHJpbnQgIjxzY3JpcHQ+ XG4iOworcHJpbnQgInZhciByZXN1bHQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgncmVzdWx0 Jyk7XG4iOworcHJpbnQgInJlc3VsdC5maXJzdENoaWxkLm5vZGVWYWx1ZSA9ICdGQUlMJztcbiI7 CitwcmludCAiPC9zY3JpcHQ+XG4iOworcHJpbnQgIjwvYm9keT5cbiI7CitwcmludCAiPC9odG1s PlxuIjsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJD b3JlL0NoYW5nZUxvZwppbmRleCAwODdiMzE3N2Y5OTdlYzE2OTg1MWFmMGZmMjcwZGE0OGIzMzk1 MWM5Li5iZDE2YjAwNjgwODBmOTJjNTY0MzBlOGJlYzY1MzkwNGRkMmYxZGNiIDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9n CkBAIC0xLDMgKzEsMjEgQEAKKzIwMTEtMDItMTYgIEpvY2hlbiBFaXNpbmdlciAgPGpvY2hlbkBj aHJvbWl1bS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgZGlzYWJsZSBleGVjdXRpb24gb2YgaW5saW5lIHNjcmlwdHMgd2hlbiBhIGNvbnRlbnQg c2VjdXJpdHkgcG9saWN5IGlzIHByZXNlbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTU0NTUxCisKKyAgICAgICAgVGVzdDogaHR0cC90ZXN0cy9zZWN1 cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvaW5saW5lLXNjcmlwdC5odG1sCisKKyAgICAgICAg KiBodG1sL3BhcnNlci9IVE1MRG9jdW1lbnRQYXJzZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6 SFRNTERvY3VtZW50UGFyc2VyOjpzaG91bGRSdW5JbmxpbmVTY3JpcHRzKToKKyAgICAgICAgKiBo dG1sL3BhcnNlci9IVE1MRG9jdW1lbnRQYXJzZXIuaDoKKyAgICAgICAgKiBodG1sL3BhcnNlci9I VE1MU2NyaXB0UnVubmVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkhUTUxTY3JpcHRSdW5uZXI6 OnJ1blNjcmlwdCk6CisgICAgICAgICogaHRtbC9wYXJzZXIvSFRNTFNjcmlwdFJ1bm5lckhvc3Qu aDoKKyAgICAgICAgKiBwYWdlL0NvbnRlbnRTZWN1cml0eVBvbGljeS5oOgorICAgICAgICAoV2Vi Q29yZTo6Q29udGVudFNlY3VyaXR5UG9saWN5OjpoYXNQb2xpY3kpOgorCiAyMDExLTAyLTE0ICBN aWtoYWlsIE5hZ2Fub3YgIDxtbmFnYW5vdkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmV2aWV3 ZWQgYnkgUGF2ZWwgRmVsZG1hbi4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFy c2VyL0hUTUxEb2N1bWVudFBhcnNlci5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9I VE1MRG9jdW1lbnRQYXJzZXIuY3BwCmluZGV4IDc5M2Y3ZTU2MGQ2ZTVkZjAzMzVlMmJkN2MwNWNi MzcxMDE1ZmNmN2YuLmE4OWJiZGIxMTZiMDA5YjAyNWFjNDBlN2QzNGRkNzk4YWQ1MTRiMWMgMTAw NjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL0hUTUxEb2N1bWVudFBhcnNlci5j cHAKKysrIGIvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTERvY3VtZW50UGFyc2VyLmNw cApAQCAtNDY1LDYgKzQ2NSwxMSBAQCBib29sIEhUTUxEb2N1bWVudFBhcnNlcjo6c2hvdWxkTG9h ZEV4dGVybmFsU2NyaXB0RnJvbVNyYyhjb25zdCBBdG9taWNTdHJpbmcmIHNyYwogICAgIHJldHVy biBkb2N1bWVudCgpLT5jb250ZW50U2VjdXJpdHlQb2xpY3koKS0+Y2FuTG9hZEV4dGVybmFsU2Ny aXB0RnJvbVNyYyhzcmNWYWx1ZSk7CiB9CiAKK2Jvb2wgSFRNTERvY3VtZW50UGFyc2VyOjpzaG91 bGRSdW5JbmxpbmVTY3JpcHRzKCkKK3sKKyAgICByZXR1cm4gIWRvY3VtZW50KCktPmNvbnRlbnRT ZWN1cml0eVBvbGljeSgpLT5oYXNQb2xpY3koKTsKK30KKwogdm9pZCBIVE1MRG9jdW1lbnRQYXJz ZXI6Om5vdGlmeUZpbmlzaGVkKENhY2hlZFJlc291cmNlKiBjYWNoZWRSZXNvdXJjZSkKIHsKICAg ICAvLyBwdW1wVG9rZW5pemVyIGNhbiBjYXVzZSB0aGlzIHBhcnNlciB0byBiZSBkZXRhY2hlZCBm cm9tIHRoZSBEb2N1bWVudCwKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2Vy L0hUTUxEb2N1bWVudFBhcnNlci5oIGIvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTERv Y3VtZW50UGFyc2VyLmgKaW5kZXggYmUyY2ExYmEyNzlkZDAzMGI2ZThhZThmNTcwNWQwY2JjOTQ2 YWU1OS4uZjY3ZmY3M2E0MzkwMWNmYTFhMzM0MWUxOTQ1OGNkODJkMjAzZmY0NyAxMDA2NDQKLS0t IGEvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTERvY3VtZW50UGFyc2VyLmgKKysrIGIv U291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTERvY3VtZW50UGFyc2VyLmgKQEAgLTEwNyw2 ICsxMDcsNyBAQCBwcml2YXRlOgogICAgIHZpcnR1YWwgdm9pZCB3YXRjaEZvckxvYWQoQ2FjaGVk UmVzb3VyY2UqKTsKICAgICB2aXJ0dWFsIHZvaWQgc3RvcFdhdGNoaW5nRm9yTG9hZChDYWNoZWRS ZXNvdXJjZSopOwogICAgIHZpcnR1YWwgYm9vbCBzaG91bGRMb2FkRXh0ZXJuYWxTY3JpcHRGcm9t U3JjKGNvbnN0IEF0b21pY1N0cmluZyYpOworICAgIHZpcnR1YWwgYm9vbCBzaG91bGRSdW5Jbmxp bmVTY3JpcHRzKCk7CiAgICAgdmlydHVhbCBIVE1MSW5wdXRTdHJlYW0mIGlucHV0U3RyZWFtKCkg eyByZXR1cm4gbV9pbnB1dDsgfQogCiAgICAgLy8gQ2FjaGVkUmVzb3VyY2VDbGllbnQKZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL0hUTUxTY3JpcHRSdW5uZXIuY3BwIGIv U291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTFNjcmlwdFJ1bm5lci5jcHAKaW5kZXggYzk5 ODU4ZDBjZmU1ZjNjZThmMjAyOWRjOWVhZmZmMThkZWU5ZGE4MS4uY2VmODM4MThjZjk5M2ZmODc0 ZmVkOWJkZDk0M2IyNjUyZGFjNDc5NyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaHRtbC9w YXJzZXIvSFRNTFNjcmlwdFJ1bm5lci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJz ZXIvSFRNTFNjcmlwdFJ1bm5lci5jcHAKQEAgLTMwNCwxNyArMzA0LDE5IEBAIHZvaWQgSFRNTFNj cmlwdFJ1bm5lcjo6cnVuU2NyaXB0KEVsZW1lbnQqIHNjcmlwdCwgY29uc3QgVGV4dFBvc2l0aW9u MSYgc2NyaXB0U3RhCiAgICAgICAgICAgICAgICAgcmVxdWVzdERlZmVycmVkU2NyaXB0KHNjcmlw dCk7CiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgICAgcmVxdWVzdFBhcnNpbmdCbG9j a2luZ1NjcmlwdChzY3JpcHQpOwotICAgICAgICB9IGVsc2UgaWYgKCFtX2RvY3VtZW50LT5oYXZl U3R5bGVzaGVldHNMb2FkZWQoKSAmJiBtX3NjcmlwdE5lc3RpbmdMZXZlbCA9PSAxKSB7Ci0gICAg ICAgICAgICAvLyBCbG9jayBpbmxpbmUgc2NyaXB0IGV4ZWN1dGlvbiBvbiBzdHlsZXNoZWV0IGxv YWQsIHVubGVzcyB3ZSBhcmUgaW4gZG9jdW1lbnQud3JpdGUoKS4KLSAgICAgICAgICAgIC8vIFRo ZSBsYXR0ZXIgY2FzZSBjYW4gb25seSBoYXBwZW4gaWYgYSBzY3JpcHQgYm90aCB0cmlnZ2VycyBh IHN0eWxlc2hlZXQgbG9hZAotICAgICAgICAgICAgLy8gYW5kIHdyaXRlcyBhbiBpbmxpbmUgc2Ny aXB0LiBTaW5jZSB3cml0ZSBpcyBibG9ja2luZyB3ZSBoYXZlIHRvIGV4ZWN1dGUgdGhlCi0gICAg ICAgICAgICAvLyB3cml0dGVuIHNjcmlwdCBpbW1lZGlhdGVseSwgaWdub3JpbmcgdGhlIHBlbmRp bmcgc2hlZXRzLgotICAgICAgICAgICAgbV9wYXJzaW5nQmxvY2tpbmdTY3JpcHQuc2V0RWxlbWVu dChzY3JpcHQpOwotICAgICAgICAgICAgbV9wYXJzaW5nQmxvY2tpbmdTY3JpcHQuc2V0U3RhcnRp bmdQb3NpdGlvbihzY3JpcHRTdGFydFBvc2l0aW9uKTsKLSAgICAgICAgfSBlbHNlIHsKLSAgICAg ICAgICAgIEFTU0VSVChpc0V4ZWN1dGluZ1NjcmlwdCgpKTsKLSAgICAgICAgICAgIFNjcmlwdFNv dXJjZUNvZGUgc291cmNlQ29kZShzY3JpcHQtPnRleHRDb250ZW50KCksIGRvY3VtZW50VVJMRm9y U2NyaXB0RXhlY3V0aW9uKG1fZG9jdW1lbnQpLCBzY3JpcHRTdGFydFBvc2l0aW9uKTsKLSAgICAg ICAgICAgIHNjcmlwdEVsZW1lbnQtPmV4ZWN1dGVTY3JpcHQoc291cmNlQ29kZSk7CisgICAgICAg IH0gZWxzZSBpZiAobV9ob3N0LT5zaG91bGRSdW5JbmxpbmVTY3JpcHRzKCkpIHsKKyAgICAgICAg ICAgIGlmICghbV9kb2N1bWVudC0+aGF2ZVN0eWxlc2hlZXRzTG9hZGVkKCkgJiYgbV9zY3JpcHRO ZXN0aW5nTGV2ZWwgPT0gMSkgeworICAgICAgICAgICAgICAgIC8vIEJsb2NrIGlubGluZSBzY3Jp cHQgZXhlY3V0aW9uIG9uIHN0eWxlc2hlZXQgbG9hZCwgdW5sZXNzIHdlIGFyZSBpbiBkb2N1bWVu dC53cml0ZSgpLgorICAgICAgICAgICAgICAgIC8vIFRoZSBsYXR0ZXIgY2FzZSBjYW4gb25seSBo YXBwZW4gaWYgYSBzY3JpcHQgYm90aCB0cmlnZ2VycyBhIHN0eWxlc2hlZXQgbG9hZAorICAgICAg ICAgICAgICAgIC8vIGFuZCB3cml0ZXMgYW4gaW5saW5lIHNjcmlwdC4gU2luY2Ugd3JpdGUgaXMg YmxvY2tpbmcgd2UgaGF2ZSB0byBleGVjdXRlIHRoZQorICAgICAgICAgICAgICAgIC8vIHdyaXR0 ZW4gc2NyaXB0IGltbWVkaWF0ZWx5LCBpZ25vcmluZyB0aGUgcGVuZGluZyBzaGVldHMuCisgICAg ICAgICAgICAgICAgbV9wYXJzaW5nQmxvY2tpbmdTY3JpcHQuc2V0RWxlbWVudChzY3JpcHQpOwor ICAgICAgICAgICAgICAgIG1fcGFyc2luZ0Jsb2NraW5nU2NyaXB0LnNldFN0YXJ0aW5nUG9zaXRp b24oc2NyaXB0U3RhcnRQb3NpdGlvbik7CisgICAgICAgICAgICB9IGVsc2UgeworICAgICAgICAg ICAgICAgIEFTU0VSVChpc0V4ZWN1dGluZ1NjcmlwdCgpKTsKKyAgICAgICAgICAgICAgICBTY3Jp cHRTb3VyY2VDb2RlIHNvdXJjZUNvZGUoc2NyaXB0LT50ZXh0Q29udGVudCgpLCBkb2N1bWVudFVS TEZvclNjcmlwdEV4ZWN1dGlvbihtX2RvY3VtZW50KSwgc2NyaXB0U3RhcnRQb3NpdGlvbik7Cisg ICAgICAgICAgICAgICAgc2NyaXB0RWxlbWVudC0+ZXhlY3V0ZVNjcmlwdChzb3VyY2VDb2RlKTsK KyAgICAgICAgICAgIH0KICAgICAgICAgfQogICAgIH0KIH0KZGlmZiAtLWdpdCBhL1NvdXJjZS9X ZWJDb3JlL2h0bWwvcGFyc2VyL0hUTUxTY3JpcHRSdW5uZXJIb3N0LmggYi9Tb3VyY2UvV2ViQ29y ZS9odG1sL3BhcnNlci9IVE1MU2NyaXB0UnVubmVySG9zdC5oCmluZGV4IDViNDBhOTMxODdmNzA4 ZGZhOTNlNWI0MDZiNDkxZmRhNDZmNzA3MDcuLjUxMDVjY2QyMWI3ODk2ZDM2YWM4MjUzYjlhOTJh Yjc4NzMwNzQxOTcgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL0hUTUxT Y3JpcHRSdW5uZXJIb3N0LmgKKysrIGIvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTFNj cmlwdFJ1bm5lckhvc3QuaApAQCAtNDYsNiArNDYsNyBAQCBwdWJsaWM6CiAKICAgICAvLyBJbXBs ZW1lbnRvcnMgY2FuIGJsb2NrIGNlcnRhaW4gc2NyaXB0IGxvYWRzIChmb3IgWFNTQXVkaXRvciwg ZXRjLikKICAgICB2aXJ0dWFsIGJvb2wgc2hvdWxkTG9hZEV4dGVybmFsU2NyaXB0RnJvbVNyYyhj b25zdCBBdG9taWNTdHJpbmcmKSA9IDA7CisgICAgdmlydHVhbCBib29sIHNob3VsZFJ1bklubGlu ZVNjcmlwdHMoKSA9IDA7CiAgICAgdmlydHVhbCBIVE1MSW5wdXRTdHJlYW0mIGlucHV0U3RyZWFt KCkgPSAwOwogfTsKIApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGFnZS9Db250ZW50U2Vj dXJpdHlQb2xpY3kuaCBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvQ29udGVudFNlY3VyaXR5UG9saWN5 LmgKaW5kZXggYzlmODk3YjYyZTFiOTc0YzZjZDIzMDE5NTIyYTUwMDUzOTYzYmY2My4uYjYwNDIx NzQ3N2EyZjljZmFkYjBlMDJkODdkMzM5YWM4YjkwZWI1NyAxMDA2NDQKLS0tIGEvU291cmNlL1dl YkNvcmUvcGFnZS9Db250ZW50U2VjdXJpdHlQb2xpY3kuaAorKysgYi9Tb3VyY2UvV2ViQ29yZS9w YWdlL0NvbnRlbnRTZWN1cml0eVBvbGljeS5oCkBAIC0zOSw2ICszOSw4IEBAIHB1YmxpYzoKICAg ICBDb250ZW50U2VjdXJpdHlQb2xpY3koKTsKICAgICB+Q29udGVudFNlY3VyaXR5UG9saWN5KCk7 CiAKKyAgICBib29sIGhhc1BvbGljeSgpIGNvbnN0IHsgcmV0dXJuIG1faGF2ZVBvbGljeTsgfQor CiAgICAgdm9pZCBkaWRSZWNlaXZlSGVhZGVyKGNvbnN0IFN0cmluZyYpOwogICAgIGJvb2wgY2Fu TG9hZEV4dGVybmFsU2NyaXB0RnJvbVNyYyhjb25zdCBTdHJpbmcmIHVybCkgY29uc3Q7CiAK