57278 2011-03-28 15:29:08 -0700 CSP script-src should block string arguments to setTimeout and setInterval 2011-04-26 09:55:22 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Other OS X 10.5 RESOLVED FIXED P2 Normal --- 53572 1 abarth abarth commit-queue darin dimich eric oldest_to_newest 374833 0 abarth 2011-03-28 15:29:08 -0700 CSP script-src should block string arguments to setTimeout and setInterval 374836 1 87220 abarth 2011-03-28 15:31:44 -0700 Created attachment 87220 Patch 374860 2 87220 darin 2011-03-28 16:06:31 -0700 Comment on attachment 87220 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=87220&action=review > Source/WebCore/ChangeLog:10 > + The changes to V8 and JSC aren't as symmetrical as I would like because > + this code path is factored differently in the two bindings. I've added > + a FIXME to synchronize the implementations. The DOMWindow functions should be usable by the V8 version. > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:736 > + if (exec->hadException() || !action) So the design here is to silently do nothing if there is a violation? > Source/WebCore/bindings/js/ScheduledAction.cpp:57 > + if (activeContext->isDocument() && !static_cast<Document*>(activeContext)->contentSecurityPolicy()->allowScriptFromString()) > + return 0; Do we want to have a contentSecurityPolicy for workers too, longer term? 374870 3 abarth 2011-03-28 16:12:43 -0700 (In reply to comment #2) > (From update of attachment 87220 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=87220&action=review > > > Source/WebCore/ChangeLog:10 > > + The changes to V8 and JSC aren't as symmetrical as I would like because > > + this code path is factored differently in the two bindings. I've added > > + a FIXME to synchronize the implementations. > > The DOMWindow functions should be usable by the V8 version. Yep! > > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:736 > > + if (exec->hadException() || !action) > > So the design here is to silently do nothing if there is a violation? Normall these functions return a non-zero value upon success (the ID to use to cancel the timeout). In this patch, we're returning undefined, which isn't really a silent failure. Another option is to throw an exception. I'll update the implementation to match whatever the working group decides. > > Source/WebCore/bindings/js/ScheduledAction.cpp:57 > > + if (activeContext->isDocument() && !static_cast<Document*>(activeContext)->contentSecurityPolicy()->allowScriptFromString()) > > + return 0; > > Do we want to have a contentSecurityPolicy for workers too, longer term? We could, although the use cases aren't very compelling. CSP is mostly about blocking XSS and it's pretty hard to XSS yourself in a worker (although it can be done). If we want to do that, we'll move the ContentSecurityPolicy object onto ScriptExecutionContext from Document. Thanks for the review! 374933 4 darin 2011-03-28 18:14:15 -0700 (In reply to comment #3) > > > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:736 > > > + if (exec->hadException() || !action) > > > > So the design here is to silently do nothing if there is a violation? > > Normall these functions return a non-zero value upon success (the ID to use to cancel the timeout). In this patch, we're returning undefined, which isn't really a silent failure. Another option is to throw an exception. I'll update the implementation to match whatever the working group decides. Returning null or 0 are other options. 374934 5 abarth 2011-03-28 18:18:18 -0700 (In reply to comment #4) > (In reply to comment #3) > > > > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:736 > > > > + if (exec->hadException() || !action) > > > > > > So the design here is to silently do nothing if there is a violation? > > > > Normall these functions return a non-zero value upon success (the ID to use to cancel the timeout). In this patch, we're returning undefined, which isn't really a silent failure. Another option is to throw an exception. I'll update the implementation to match whatever the working group decides. > > Returning null or 0 are other options. Yep. Do you have a preference among these options? The behavior is far from set in stone at this point. 374966 6 darin 2011-03-28 20:08:42 -0700 (In reply to comment #5) > Do you have a preference among these options? I don’t have a preference. For a special value, null seems a good choice. The undefined value seems like more of a special artifact so probably less good than null. Returning the number 0 seems a language-independent choice, since the function returns an integer in the other cases. An exception also seems OK. 375220 7 87220 commit-queue 2011-03-29 05:55:45 -0700 Comment on attachment 87220 Patch Rejecting attachment 87220 from commit-queue. Failed to run "['./Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '--bot-id=cr-jail-7', 'build-..." exit_code: 2 Last 500 characters of output: /span .............. fast/multicol/vertical-lr .............. fast/multicol/vertical-rl .............. fast/overflow ................................................... fast/parser ............................................................................... fast/parser/iframe-sets-parent-to-javascript-url.html -> crashed Exiting early after 1 failures. 10321 tests run. 385.43s total testing time 10320 test cases (99%) succeeded 1 test case (<1%) crashed 6 test cases (<1%) had stderr output Full output: http://queues.webkit.org/results/8285265 392532 8 abarth 2011-04-26 09:55:22 -0700 I fixed this in another patch. 87220 2011-03-28 15:31:44 -0700 2011-03-29 05:55:45 -0700 Patch bug-57278-20110328153143.patch text/plain 13871 abarth SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDgyMTY2KQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMzcgQEAKKzIwMTEtMDMtMjggIEFkYW0gQmFy dGggIDxhYmFydGhAd2Via2l0Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBDU1Agc2NyaXB0LXNyYyBzaG91bGQgYmxvY2sgc3RyaW5nIGFyZ3Vt ZW50cyB0byBzZXRUaW1lb3V0IGFuZCBzZXRJbnRlcnZhbAorICAgICAgICBodHRwczovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NTcyNzgKKworICAgICAgICBUaGUgY2hhbmdlcyB0 byBWOCBhbmQgSlNDIGFyZW4ndCBhcyBzeW1tZXRyaWNhbCBhcyBJIHdvdWxkIGxpa2UgYmVjYXVz ZQorICAgICAgICB0aGlzIGNvZGUgcGF0aCBpcyBmYWN0b3JlZCBkaWZmZXJlbnRseSBpbiB0aGUg dHdvIGJpbmRpbmdzLiAgSSd2ZSBhZGRlZAorICAgICAgICBhIEZJWE1FIHRvIHN5bmNocm9uaXpl IHRoZSBpbXBsZW1lbnRhdGlvbnMuCisKKyAgICAgICAgVGhlIGV4YWN0IGVycm9yIGhhbmRsaW5n IGJlaGF2aW9yIGZvciB0aGlzIGNhc2UgaXNuJ3QgZGVmaW5lZCBieSB0aGUKKyAgICAgICAgQ1NQ IHNwZWMuICBJJ3ZlIHNlbnQgYW4gZW1haWwgdG8gdGhlIHdvcmtpbmcgZ3JvdXAgYXNraW5nIGZv cgorICAgICAgICBjbGFyaWZpY2F0aW9uIGFib3V0IGhvdyBleGFjdGx5IHRoZSBlcnJvciBzaG91 bGQgYmUgcmVwb3J0ZWQuCisKKyAgICAgICAgVGVzdDogaHR0cC90ZXN0cy9zZWN1cml0eS9jb250 ZW50U2VjdXJpdHlQb2xpY3kvc2NyaXB0LXNyYy1zZXQtdGltZW91dC5odG1sCisKKyAgICAgICAg KiBiaW5kaW5ncy9qcy9KU0RPTVdpbmRvd0N1c3RvbS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpK U0RPTVdpbmRvdzo6c2V0VGltZW91dCk6CisgICAgICAgIChXZWJDb3JlOjpKU0RPTVdpbmRvdzo6 c2V0SW50ZXJ2YWwpOgorICAgICAgICAqIGJpbmRpbmdzL2pzL0pTV29ya2VyQ29udGV4dEN1c3Rv bS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpKU1dvcmtlckNvbnRleHQ6OnNldFRpbWVvdXQpOgor ICAgICAgICAoV2ViQ29yZTo6SlNXb3JrZXJDb250ZXh0OjpzZXRJbnRlcnZhbCk6CisgICAgICAg ICogYmluZGluZ3MvanMvU2NoZWR1bGVkQWN0aW9uLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNj aGVkdWxlZEFjdGlvbjo6Y3JlYXRlKToKKyAgICAgICAgKiBiaW5kaW5ncy9qcy9TY2hlZHVsZWRB Y3Rpb24uaDoKKyAgICAgICAgKiBiaW5kaW5ncy92OC9TY2hlZHVsZWRBY3Rpb24uaDoKKyAgICAg ICAgKFdlYkNvcmU6OlNjaGVkdWxlZEFjdGlvbjo6U2NoZWR1bGVkQWN0aW9uKToKKyAgICAgICAg KiBiaW5kaW5ncy92OC9jdXN0b20vVjhET01XaW5kb3dDdXN0b20uY3BwOgorICAgICAgICAoV2Vi Q29yZTo6V2luZG93U2V0VGltZW91dEltcGwpOgorICAgICAgICAqIHBhZ2UvQ29udGVudFNlY3Vy aXR5UG9saWN5LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkNvbnRlbnRTZWN1cml0eVBvbGljeTo6 YWxsb3dTY3JpcHRGcm9tU3RyaW5nKToKKyAgICAgICAgKiBwYWdlL0NvbnRlbnRTZWN1cml0eVBv bGljeS5oOgorCiAyMDExLTAzLTI4ICBFcmljIENhcmxzb24gIDxlcmljLmNhcmxzb25AYXBwbGUu Y29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERhcmluIEFkbGVyLgpJbmRleDogU291cmNlL1dl YkNvcmUvYmluZGluZ3MvanMvSlNET01XaW5kb3dDdXN0b20uY3BwCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv dXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTRE9NV2luZG93Q3VzdG9tLmNwcAkocmV2aXNpb24g ODIxNDYpCisrKyBTb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0RPTVdpbmRvd0N1c3RvbS5j cHAJKHdvcmtpbmcgY29weSkKQEAgLTczMiw4ICs3MzIsOCBAQCBKU1ZhbHVlIEpTRE9NV2luZG93 Ojpwb3N0TWVzc2FnZShFeGVjU3RhCiAKIEpTVmFsdWUgSlNET01XaW5kb3c6OnNldFRpbWVvdXQo RXhlY1N0YXRlKiBleGVjKQogewotICAgIE93blB0cjxTY2hlZHVsZWRBY3Rpb24+IGFjdGlvbiA9 IFNjaGVkdWxlZEFjdGlvbjo6Y3JlYXRlKGV4ZWMsIGN1cnJlbnRXb3JsZChleGVjKSk7Ci0gICAg aWYgKGV4ZWMtPmhhZEV4Y2VwdGlvbigpKQorICAgIE93blB0cjxTY2hlZHVsZWRBY3Rpb24+IGFj dGlvbiA9IFNjaGVkdWxlZEFjdGlvbjo6Y3JlYXRlKGV4ZWMsIGFjdGl2ZURPTVdpbmRvdyhleGVj KS0+c2NyaXB0RXhlY3V0aW9uQ29udGV4dCgpLCBjdXJyZW50V29ybGQoZXhlYykpOworICAgIGlm IChleGVjLT5oYWRFeGNlcHRpb24oKSB8fCAhYWN0aW9uKQogICAgICAgICByZXR1cm4ganNVbmRl ZmluZWQoKTsKICAgICBpbnQgZGVsYXkgPSBleGVjLT5hcmd1bWVudCgxKS50b0ludDMyKGV4ZWMp OwogCkBAIC03NDYsOCArNzQ2LDggQEAgSlNWYWx1ZSBKU0RPTVdpbmRvdzo6c2V0VGltZW91dChF eGVjU3RhdAogCiBKU1ZhbHVlIEpTRE9NV2luZG93OjpzZXRJbnRlcnZhbChFeGVjU3RhdGUqIGV4 ZWMpCiB7Ci0gICAgT3duUHRyPFNjaGVkdWxlZEFjdGlvbj4gYWN0aW9uID0gU2NoZWR1bGVkQWN0 aW9uOjpjcmVhdGUoZXhlYywgY3VycmVudFdvcmxkKGV4ZWMpKTsKLSAgICBpZiAoZXhlYy0+aGFk RXhjZXB0aW9uKCkpCisgICAgT3duUHRyPFNjaGVkdWxlZEFjdGlvbj4gYWN0aW9uID0gU2NoZWR1 bGVkQWN0aW9uOjpjcmVhdGUoZXhlYywgYWN0aXZlRE9NV2luZG93KGV4ZWMpLT5zY3JpcHRFeGVj dXRpb25Db250ZXh0KCksIGN1cnJlbnRXb3JsZChleGVjKSk7CisgICAgaWYgKGV4ZWMtPmhhZEV4 Y2VwdGlvbigpIHx8ICFhY3Rpb24pCiAgICAgICAgIHJldHVybiBqc1VuZGVmaW5lZCgpOwogICAg IGludCBkZWxheSA9IGV4ZWMtPmFyZ3VtZW50KDEpLnRvSW50MzIoZXhlYyk7CiAKSW5kZXg6IFNv dXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTV29ya2VyQ29udGV4dEN1c3RvbS5jcHAKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gU291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNXb3JrZXJDb250ZXh0Q3VzdG9t LmNwcAkocmV2aXNpb24gODIxNDYpCisrKyBTb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU1dv cmtlckNvbnRleHRDdXN0b20uY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMjIsOCArMTIyLDggQEAg SlNWYWx1ZSBKU1dvcmtlckNvbnRleHQ6OmltcG9ydFNjcmlwdHMoRQogCiBKU1ZhbHVlIEpTV29y a2VyQ29udGV4dDo6c2V0VGltZW91dChFeGVjU3RhdGUqIGV4ZWMpCiB7Ci0gICAgT3duUHRyPFNj aGVkdWxlZEFjdGlvbj4gYWN0aW9uID0gU2NoZWR1bGVkQWN0aW9uOjpjcmVhdGUoZXhlYywgY3Vy cmVudFdvcmxkKGV4ZWMpKTsKLSAgICBpZiAoZXhlYy0+aGFkRXhjZXB0aW9uKCkpCisgICAgT3du UHRyPFNjaGVkdWxlZEFjdGlvbj4gYWN0aW9uID0gU2NoZWR1bGVkQWN0aW9uOjpjcmVhdGUoZXhl YywgaW1wbCgpLCBjdXJyZW50V29ybGQoZXhlYykpOworICAgIGlmIChleGVjLT5oYWRFeGNlcHRp b24oKSB8fCAhYWN0aW9uKQogICAgICAgICByZXR1cm4ganNVbmRlZmluZWQoKTsKICAgICBpbnQg ZGVsYXkgPSBleGVjLT5hcmd1bWVudCgxKS50b0ludDMyKGV4ZWMpOwogICAgIHJldHVybiBqc051 bWJlcihpbXBsKCktPnNldFRpbWVvdXQoYWN0aW9uLnJlbGVhc2UoKSwgZGVsYXkpKTsKQEAgLTEz MSw4ICsxMzEsOCBAQCBKU1ZhbHVlIEpTV29ya2VyQ29udGV4dDo6c2V0VGltZW91dChFeGVjCiAK IEpTVmFsdWUgSlNXb3JrZXJDb250ZXh0OjpzZXRJbnRlcnZhbChFeGVjU3RhdGUqIGV4ZWMpCiB7 Ci0gICAgT3duUHRyPFNjaGVkdWxlZEFjdGlvbj4gYWN0aW9uID0gU2NoZWR1bGVkQWN0aW9uOjpj cmVhdGUoZXhlYywgY3VycmVudFdvcmxkKGV4ZWMpKTsKLSAgICBpZiAoZXhlYy0+aGFkRXhjZXB0 aW9uKCkpCisgICAgT3duUHRyPFNjaGVkdWxlZEFjdGlvbj4gYWN0aW9uID0gU2NoZWR1bGVkQWN0 aW9uOjpjcmVhdGUoZXhlYywgaW1wbCgpLCBjdXJyZW50V29ybGQoZXhlYykpOworICAgIGlmIChl eGVjLT5oYWRFeGNlcHRpb24oKSB8fCAhYWN0aW9uKQogICAgICAgICByZXR1cm4ganNVbmRlZmlu ZWQoKTsKICAgICBpbnQgZGVsYXkgPSBleGVjLT5hcmd1bWVudCgxKS50b0ludDMyKGV4ZWMpOwog ICAgIHJldHVybiBqc051bWJlcihpbXBsKCktPnNldEludGVydmFsKGFjdGlvbi5yZWxlYXNlKCks IGRlbGF5KSk7CkluZGV4OiBTb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9TY2hlZHVsZWRBY3Rp b24uY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL1NjaGVkdWxl ZEFjdGlvbi5jcHAJKHJldmlzaW9uIDgyMTQ2KQorKysgU291cmNlL1dlYkNvcmUvYmluZGluZ3Mv anMvU2NoZWR1bGVkQWN0aW9uLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjQsNiArMjQsNyBAQAog I2luY2x1ZGUgImNvbmZpZy5oIgogI2luY2x1ZGUgIlNjaGVkdWxlZEFjdGlvbi5oIgogCisjaW5j bHVkZSAiQ29udGVudFNlY3VyaXR5UG9saWN5LmgiCiAjaW5jbHVkZSAiRE9NV2luZG93LmgiCiAj aW5jbHVkZSAiRG9jdW1lbnQuaCIKICNpbmNsdWRlICJGcmFtZS5oIgpAQCAtNDYsMTEgKzQ3LDE0 IEBAIHVzaW5nIG5hbWVzcGFjZSBKU0M7CiAKIG5hbWVzcGFjZSBXZWJDb3JlIHsKIAotUGFzc093 blB0cjxTY2hlZHVsZWRBY3Rpb24+IFNjaGVkdWxlZEFjdGlvbjo6Y3JlYXRlKEV4ZWNTdGF0ZSog ZXhlYywgRE9NV3JhcHBlcldvcmxkKiBpc29sYXRlZFdvcmxkKQorUGFzc093blB0cjxTY2hlZHVs ZWRBY3Rpb24+IFNjaGVkdWxlZEFjdGlvbjo6Y3JlYXRlKEV4ZWNTdGF0ZSogZXhlYywgU2NyaXB0 RXhlY3V0aW9uQ29udGV4dCogYWN0aXZlQ29udGV4dCwgRE9NV3JhcHBlcldvcmxkKiBpc29sYXRl ZFdvcmxkKQogewogICAgIEpTVmFsdWUgdiA9IGV4ZWMtPmFyZ3VtZW50KDApOworCiAgICAgQ2Fs bERhdGEgY2FsbERhdGE7CiAgICAgaWYgKGdldENhbGxEYXRhKHYsIGNhbGxEYXRhKSA9PSBDYWxs VHlwZU5vbmUpIHsKKyAgICAgICAgaWYgKGFjdGl2ZUNvbnRleHQtPmlzRG9jdW1lbnQoKSAmJiAh c3RhdGljX2Nhc3Q8RG9jdW1lbnQqPihhY3RpdmVDb250ZXh0KS0+Y29udGVudFNlY3VyaXR5UG9s aWN5KCktPmFsbG93U2NyaXB0RnJvbVN0cmluZygpKQorICAgICAgICAgICAgcmV0dXJuIDA7CiAg ICAgICAgIFVTdHJpbmcgc3RyaW5nID0gdi50b1N0cmluZyhleGVjKTsKICAgICAgICAgaWYgKGV4 ZWMtPmhhZEV4Y2VwdGlvbigpKQogICAgICAgICAgICAgcmV0dXJuIDA7CkluZGV4OiBTb3VyY2Uv V2ViQ29yZS9iaW5kaW5ncy9qcy9TY2hlZHVsZWRBY3Rpb24uaAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy Y2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9TY2hlZHVsZWRBY3Rpb24uaAkocmV2aXNpb24gODIxNDYp CisrKyBTb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9TY2hlZHVsZWRBY3Rpb24uaAkod29ya2lu ZyBjb3B5KQpAQCAtNDQsNyArNDQsNyBAQCBuYW1lc3BhY2UgV2ViQ29yZSB7CiAgICAgY2xhc3Mg U2NoZWR1bGVkQWN0aW9uIHsKICAgICAgICAgV1RGX01BS0VfTk9OQ09QWUFCTEUoU2NoZWR1bGVk QWN0aW9uKTsgV1RGX01BS0VfRkFTVF9BTExPQ0FURUQ7CiAgICAgcHVibGljOgotICAgICAgICBz dGF0aWMgUGFzc093blB0cjxTY2hlZHVsZWRBY3Rpb24+IGNyZWF0ZShKU0M6OkV4ZWNTdGF0ZSos IERPTVdyYXBwZXJXb3JsZCogaXNvbGF0ZWRXb3JsZCk7CisgICAgICAgIHN0YXRpYyBQYXNzT3du UHRyPFNjaGVkdWxlZEFjdGlvbj4gY3JlYXRlKEpTQzo6RXhlY1N0YXRlKiwgU2NyaXB0RXhlY3V0 aW9uQ29udGV4dCogYWN0aXZlQ29udGV4dCwgRE9NV3JhcHBlcldvcmxkKiBpc29sYXRlZFdvcmxk KTsKIAogICAgICAgICB2b2lkIGV4ZWN1dGUoU2NyaXB0RXhlY3V0aW9uQ29udGV4dCopOwogCklu ZGV4OiBTb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy92OC9TY2hlZHVsZWRBY3Rpb24uaAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy92OC9TY2hlZHVsZWRBY3Rpb24uaAkocmV2 aXNpb24gODIxNDYpCisrKyBTb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy92OC9TY2hlZHVsZWRBY3Rp b24uaAkod29ya2luZyBjb3B5KQpAQCAtNDcsNyArNDcsOCBAQCBuYW1lc3BhY2UgV2ViQ29yZSB7 CiAgICAgY2xhc3MgU2NoZWR1bGVkQWN0aW9uIHsKICAgICBwdWJsaWM6CiAgICAgICAgIFNjaGVk dWxlZEFjdGlvbih2ODo6SGFuZGxlPHY4OjpDb250ZXh0Piwgdjg6OkhhbmRsZTx2ODo6RnVuY3Rp b24+LCBpbnQgYXJnYywgdjg6OkhhbmRsZTx2ODo6VmFsdWU+IGFyZ3ZbXSk7Ci0gICAgICAgIGV4 cGxpY2l0IFNjaGVkdWxlZEFjdGlvbih2ODo6SGFuZGxlPHY4OjpDb250ZXh0PiBjb250ZXh0LCBj b25zdCBXVEY6OlN0cmluZyYgY29kZSwgY29uc3QgS1VSTCYgdXJsID0gS1VSTCgpKQorCisgICAg ICAgIFNjaGVkdWxlZEFjdGlvbih2ODo6SGFuZGxlPHY4OjpDb250ZXh0PiBjb250ZXh0LCBjb25z dCBXVEY6OlN0cmluZyYgY29kZSwgY29uc3QgS1VSTCYgdXJsID0gS1VSTCgpKQogICAgICAgICAg ICAgOiBtX2NvbnRleHQoY29udGV4dCkKICAgICAgICAgICAgICwgbV9hcmdjKDApCiAgICAgICAg ICAgICAsIG1fYXJndigwKQpJbmRleDogU291cmNlL1dlYkNvcmUvYmluZGluZ3MvdjgvY3VzdG9t L1Y4RE9NV2luZG93Q3VzdG9tLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9iaW5k aW5ncy92OC9jdXN0b20vVjhET01XaW5kb3dDdXN0b20uY3BwCShyZXZpc2lvbiA4MjE0NikKKysr IFNvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL3Y4L2N1c3RvbS9WOERPTVdpbmRvd0N1c3RvbS5jcHAJ KHdvcmtpbmcgY29weSkKQEAgLTMyLDYgKzMyLDcgQEAKICNpbmNsdWRlICJWOERPTVdpbmRvdy5o IgogCiAjaW5jbHVkZSAiQ2hyb21lLmgiCisjaW5jbHVkZSAiQ29udGVudFNlY3VyaXR5UG9saWN5 LmgiCiAjaW5jbHVkZSAiRE9NVGltZXIuaCIKICNpbmNsdWRlICJET01XaW5kb3cuaCIKICNpbmNs dWRlICJFeGNlcHRpb25Db2RlLmgiCkBAIC03MCw2ICs3MSw3IEBACiAKIG5hbWVzcGFjZSBXZWJD b3JlIHsKIAorLy8gRklYTUU6IEFsaWduIHRoZSBWOCBpbXBsZW1lbnRhdGlvbiBvZiBzZXRUaW1l b3V0IGFuZCBzZXRJbnRlcnZhbCB3aXRoIHRoZSBKU0MgdmVyc2lvbi4KIHY4OjpIYW5kbGU8djg6 OlZhbHVlPiBXaW5kb3dTZXRUaW1lb3V0SW1wbChjb25zdCB2ODo6QXJndW1lbnRzJiBhcmdzLCBi b29sIHNpbmdsZVNob3QpCiB7CiAgICAgaW50IGFyZ3VtZW50Q291bnQgPSBhcmdzLkxlbmd0aCgp OwpAQCAtMTMxLDYgKzEzMyw4IEBAIHY4OjpIYW5kbGU8djg6OlZhbHVlPiBXaW5kb3dTZXRUaW1l b3V0SW0KIAogICAgICAgICBpZCA9IERPTVRpbWVyOjppbnN0YWxsKHNjcmlwdENvbnRleHQsIGFj dGlvbiwgdGltZW91dCwgc2luZ2xlU2hvdCk7CiAgICAgfSBlbHNlIHsKKyAgICAgICAgaWYgKCFW OEJpbmRpbmdTdGF0ZTo6T25seSgpLT5hY3RpdmVXaW5kb3coKS0+ZG9jdW1lbnQoKS0+Y29udGVu dFNlY3VyaXR5UG9saWN5KCktPmFsbG93U2NyaXB0RnJvbVN0cmluZygpKQorICAgICAgICAgICAg cmV0dXJuIHY4OjpVbmRlZmluZWQoKTsKICAgICAgICAgaWQgPSBET01UaW1lcjo6aW5zdGFsbChz Y3JpcHRDb250ZXh0LCBuZXcgU2NoZWR1bGVkQWN0aW9uKFY4UHJveHk6OmNvbnRleHQoaW1wLT5m cmFtZSgpKSwgZnVuY3Rpb25TdHJpbmcpLCB0aW1lb3V0LCBzaW5nbGVTaG90KTsKICAgICB9CiAK SW5kZXg6IFNvdXJjZS9XZWJDb3JlL3BhZ2UvQ29udGVudFNlY3VyaXR5UG9saWN5LmNwcAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9wYWdlL0NvbnRlbnRTZWN1cml0eVBvbGljeS5jcHAJ KHJldmlzaW9uIDgyMTQ3KQorKysgU291cmNlL1dlYkNvcmUvcGFnZS9Db250ZW50U2VjdXJpdHlQ b2xpY3kuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00MzUsNiArNDM1LDExIEBAIGJvb2wgQ29udGVu dFNlY3VyaXR5UG9saWN5OjphbGxvd0lubGluZUUKICAgICByZXR1cm4gIW1fc2NyaXB0U3JjOwog fQogCitib29sIENvbnRlbnRTZWN1cml0eVBvbGljeTo6YWxsb3dTY3JpcHRGcm9tU3RyaW5nKCkg Y29uc3QKK3sKKyAgICByZXR1cm4gIW1fc2NyaXB0U3JjOworfQorCiBib29sIENvbnRlbnRTZWN1 cml0eVBvbGljeTo6YWxsb3dTY3JpcHRGcm9tU291cmNlKGNvbnN0IEtVUkwmIHVybCkgY29uc3QK IHsKICAgICByZXR1cm4gIW1fc2NyaXB0U3JjIHx8IG1fc2NyaXB0U3JjLT5hbGxvd3ModXJsKTsK SW5kZXg6IFNvdXJjZS9XZWJDb3JlL3BhZ2UvQ29udGVudFNlY3VyaXR5UG9saWN5LmgKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gU291cmNlL1dlYkNvcmUvcGFnZS9Db250ZW50U2VjdXJpdHlQb2xpY3kuaAkocmV2 aXNpb24gODIxNDcpCisrKyBTb3VyY2UvV2ViQ29yZS9wYWdlL0NvbnRlbnRTZWN1cml0eVBvbGlj eS5oCSh3b3JraW5nIGNvcHkpCkBAIC00Nyw2ICs0Nyw3IEBAIHB1YmxpYzoKIAogICAgIGJvb2wg YWxsb3dKYXZhU2NyaXB0VVJMcygpIGNvbnN0OwogICAgIGJvb2wgYWxsb3dJbmxpbmVFdmVudEhh bmRsZXJzKCkgY29uc3Q7CisgICAgYm9vbCBhbGxvd1NjcmlwdEZyb21TdHJpbmcoKSBjb25zdDsK ICAgICBib29sIGFsbG93U2NyaXB0RnJvbVNvdXJjZShjb25zdCBLVVJMJikgY29uc3Q7CiAKIHBy aXZhdGU6CkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0 VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lvbiA4MjE2NikKKysrIExheW91dFRlc3RzL0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDExLTAzLTI4ICBBZGFtIEJhcnRo ICA8YWJhcnRoQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgQ1NQIHNjcmlwdC1zcmMgc2hvdWxkIGJsb2NrIHN0cmluZyBhcmd1bWVu dHMgdG8gc2V0VGltZW91dCBhbmQgc2V0SW50ZXJ2YWwKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU3Mjc4CisKKyAgICAgICAgVGVzdHMgd2l0aCBwb3Np dGl2ZSBhbmQgbmVnYXRpdmUgY29udHJvbHMuCisKKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3Vy aXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9yZXNvdXJjZXMvc2V0LWludGVydmFsLmpzOiBBZGRl ZC4KKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9y ZXNvdXJjZXMvc2V0LXRpbWVvdXQuanM6IEFkZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMvc2Vj dXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3NjcmlwdC1zcmMtc2V0LXRpbWVvdXQtZXhwZWN0 ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1 cml0eVBvbGljeS9zY3JpcHQtc3JjLXNldC10aW1lb3V0Lmh0bWw6IEFkZGVkLgorCiAyMDExLTAz LTI4ICBBbmR5IEVzdGVzICA8YWVzdGVzQGFwcGxlLmNvbT4KIAogICAgICAgICBDaGVjayBpbiBm YWlsaW5nIHJlc3VsdHMgZm9yIGVtYmVkLXByZWZlcnMtcGx1Z2lucy1mb3ItaW1hZ2VzLmh0bWwg b24gTGVvcGFyZC4KSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVu dFNlY3VyaXR5UG9saWN5L3NjcmlwdC1zcmMtc2V0LXRpbWVvdXQtZXhwZWN0ZWQudHh0Cj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5 UG9saWN5L3NjcmlwdC1zcmMtc2V0LXRpbWVvdXQtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQor KysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kv c2NyaXB0LXNyYy1zZXQtdGltZW91dC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAg KzEsMjEgQEAKKyAgICAgCisKKy0tLS0tLS0tCitGcmFtZTogJzwhLS1mcmFtZVBhdGggLy88IS0t ZnJhbWUwLS0+LS0+JworLS0tLS0tLS0KK1BBU1MKKworLS0tLS0tLS0KK0ZyYW1lOiAnPCEtLWZy YW1lUGF0aCAvLzwhLS1mcmFtZTEtLT4tLT4nCistLS0tLS0tLQorUEFTUworCistLS0tLS0tLQor RnJhbWU6ICc8IS0tZnJhbWVQYXRoIC8vPCEtLWZyYW1lMi0tPi0tPicKKy0tLS0tLS0tCitQQVNT CisKKy0tLS0tLS0tCitGcmFtZTogJzwhLS1mcmFtZVBhdGggLy88IS0tZnJhbWUzLS0+LS0+Jwor LS0tLS0tLS0KK1BBU1MKSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29u dGVudFNlY3VyaXR5UG9saWN5L3NjcmlwdC1zcmMtc2V0LXRpbWVvdXQuaHRtbAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGlj eS9zY3JpcHQtc3JjLXNldC10aW1lb3V0Lmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0 cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9zY3JpcHQtc3JjLXNl dC10aW1lb3V0Lmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMjggQEAKKzwhRE9DVFlQRSBo dG1sPgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250 cm9sbGVyKSB7CisgIGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgbGF5b3V0 VGVzdENvbnRyb2xsZXIuZHVtcENoaWxkRnJhbWVzQXNUZXh0KCk7CisgIGxheW91dFRlc3RDb250 cm9sbGVyLndhaXRVbnRpbERvbmUoKTsKK30KKwordmFyIHRlc3RDb3VudCA9IDQ7CisKK3dpbmRv dy5hZGRFdmVudExpc3RlbmVyKCdtZXNzYWdlJywgZnVuY3Rpb24oKSB7CisgIGlmICgtLXRlc3RD b3VudCA+IDApCisgICAgcmV0dXJuOworCisgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xs ZXIpCisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIubm90aWZ5RG9uZSgpOworfSwgZmFsc2UpOwor PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKyAgPGlmcmFtZSBzcmM9Imh0dHA6Ly8xMjcuMC4w LjE6ODAwMC9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvcmVzb3VyY2VzL2VjaG8tc2Ny aXB0LXNyYy5wbD9zaG91bGRfcnVuPW5vJnE9aHR0cDovLzEyNy4wLjAuMTo4MDAwL3NlY3VyaXR5 L2NvbnRlbnRTZWN1cml0eVBvbGljeS9yZXNvdXJjZXMvc2V0LXRpbWVvdXQuanMmY3NwPXNjcmlw dC1zcmMlMjBodHRwOi8vMTI3LjAuMC4xOjgwMDAiPjwvaWZyYW1lPgorICA8aWZyYW1lIHNyYz0i aHR0cDovLzEyNy4wLjAuMTo4MDAwL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9yZXNv dXJjZXMvZWNoby1zY3JpcHQtc3JjLnBsP3Nob3VsZF9ydW49eWVzJnE9aHR0cDovLzEyNy4wLjAu MTo4MDAwL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9yZXNvdXJjZXMvc2V0LXRpbWVv dXQuanMmY3NwPWltZy1zcmMlMjBodHRwOi8vMTI3LjAuMC4xOjgwMDAiPjwvaWZyYW1lPgorICA8 aWZyYW1lIHNyYz0iaHR0cDovLzEyNy4wLjAuMTo4MDAwL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0 eVBvbGljeS9yZXNvdXJjZXMvZWNoby1zY3JpcHQtc3JjLnBsP3Nob3VsZF9ydW49bm8mcT1odHRw Oi8vMTI3LjAuMC4xOjgwMDAvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3Jlc291cmNl cy9zZXQtaW50ZXJ2YWwuanMmY3NwPXNjcmlwdC1zcmMlMjBodHRwOi8vMTI3LjAuMC4xOjgwMDAi PjwvaWZyYW1lPgorICA8aWZyYW1lIHNyYz0iaHR0cDovLzEyNy4wLjAuMTo4MDAwL3NlY3VyaXR5 L2NvbnRlbnRTZWN1cml0eVBvbGljeS9yZXNvdXJjZXMvZWNoby1zY3JpcHQtc3JjLnBsP3Nob3Vs ZF9ydW49eWVzJnE9aHR0cDovLzEyNy4wLjAuMTo4MDAwL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0 eVBvbGljeS9yZXNvdXJjZXMvc2V0LWludGVydmFsLmpzJmNzcD1pbWctc3JjJTIwaHR0cDovLzEy Ny4wLjAuMTo4MDAwIj48L2lmcmFtZT4KKzwvYm9keT4KKzwvaHRtbD4KSW5kZXg6IExheW91dFRl c3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3Jlc291cmNlcy9z ZXQtaW50ZXJ2YWwuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1 cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvcmVzb3VyY2VzL3NldC1pbnRlcnZhbC5qcwkocmV2 aXNpb24gMCkKKysrIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3Vy aXR5UG9saWN5L3Jlc291cmNlcy9zZXQtaW50ZXJ2YWwuanMJKHJldmlzaW9uIDApCkBAIC0wLDAg KzEsNSBAQAorc2V0SW50ZXJ2YWwoJ3ZhciByZXN1bHQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJ ZCgicmVzdWx0Iik7IHJlc3VsdC5maXJzdENoaWxkLm5vZGVWYWx1ZSA9IHJlc3VsdC5hdHRyaWJ1 dGVzLmdldE5hbWVkSXRlbSgidGV4dCIpLnZhbHVlOycsIDApOworLy8gVGhlc2Ugc2hvdWxkIGFs d2F5cyBvY2N1ciBpbiBvcmRlci4KK3NldFRpbWVvdXQoZnVuY3Rpb24gKCkgeworICAgIHRvcC5w b3N0TWVzc2FnZSgnZG9uZScsICcqJyk7Cit9LCAwKTsKSW5kZXg6IExheW91dFRlc3RzL2h0dHAv dGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3Jlc291cmNlcy9zZXQtdGltZW91 dC5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRl bnRTZWN1cml0eVBvbGljeS9yZXNvdXJjZXMvc2V0LXRpbWVvdXQuanMJKHJldmlzaW9uIDApCisr KyBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9y ZXNvdXJjZXMvc2V0LXRpbWVvdXQuanMJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsNSBAQAorc2V0 VGltZW91dCgndmFyIHJlc3VsdCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJyZXN1bHQiKTsg cmVzdWx0LmZpcnN0Q2hpbGQubm9kZVZhbHVlID0gcmVzdWx0LmF0dHJpYnV0ZXMuZ2V0TmFtZWRJ dGVtKCJ0ZXh0IikudmFsdWU7JywgMCk7CisvLyBUaGVzZSBzaG91bGQgYWx3YXlzIG9jY3VyIGlu IG9yZGVyLgorc2V0VGltZW91dChmdW5jdGlvbiAoKSB7CisgICAgdG9wLnBvc3RNZXNzYWdlKCdk b25lJywgJyonKTsKK30sIDApOwo=