81948 2012-03-22 12:18:09 -0700 XSS Auditor bypass via script tag src=data:, URLS. 2012-03-22 19:13:52 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED XSSAuditor P2 Normal --- 1 tsepez tsepez abarth dbates webkit.review.bot oldest_to_newest 585586 0 tsepez 2012-03-22 12:18:09 -0700 Originally reported by sirdarckcat at http://code.google.com/p/chromium/issues/detail?id=117329 What steps will reproduce the problem? 1. Go to http://0x.lv/xss.php?html_xss=%3Cscript%20src=%22data:,alert(1)// 585587 1 tsepez 2012-03-22 12:18:16 -0700 A minimized returned page for this looks like: <html xmlns="http://www.w3.org/1999/xhtml"> <body> <div class="lol"> <script src="data:,alert(1)// <h1>existing page clutter</h1> <script type="text/javascript">x = 2;</script> </body> </html> 585590 2 133323 tsepez 2012-03-22 12:26:59 -0700 Created attachment 133323 Testcase 585836 3 133379 tsepez 2012-03-22 16:14:31 -0700 Created attachment 133379 Patch. 585865 4 133379 abarth 2012-03-22 16:46:17 -0700 Comment on attachment 133379 Patch. View in context: https://bugs.webkit.org/attachment.cgi?id=133379&action=review > Source/WebCore/html/parser/XSSAuditor.cpp:521 > + bool commaSeen; This is a personal preference, but I think it's better to initialize scalars when they're declared (and then to have an empty first-clause in the for statement). > Source/WebCore/html/parser/XSSAuditor.cpp:530 > if (decodedSnippet[currentLength] == '?' || decodedSnippet[currentLength] == '#' At this point, I would store decodedSnippet[currentLength] in a local variable. 585881 5 133391 tsepez 2012-03-22 17:07:25 -0700 Created attachment 133391 Patch + style nits. 585986 6 133391 webkit.review.bot 2012-03-22 19:13:42 -0700 Comment on attachment 133391 Patch + style nits. Clearing flags on attachment: 133391 Committed r111808: <http://trac.webkit.org/changeset/111808> 585987 7 webkit.review.bot 2012-03-22 19:13:52 -0700 All reviewed patches have been landed. Closing bug. 133323 2012-03-22 12:26:59 -0700 2012-03-22 16:14:31 -0700 Testcase script-tag-with-source-data-url2.html text/plain 371 tsepez PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KPHNjcmlwdD4KaWYgKHdpbmRvdy5sYXlvdXRU ZXN0Q29udHJvbGxlcikgewogIGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKICBs YXlvdXRUZXN0Q29udHJvbGxlci5zZXRYU1NBdWRpdG9yRW5hYmxlZCh0cnVlKTsKfQo8L3Njcmlw dD4KPC9oZWFkPgo8Ym9keT4KPGlmcmFtZSBzcmM9Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9zZWN1 cml0eS94c3NBdWRpdG9yL3Jlc291cmNlcy9lY2hvLWludGVydGFnLnBsP2NsdXR0ZXI9PGI+Kioq PC9iPiZxPTxzY3JpcHQlMjBzcmM9JTIyZGF0YTosYWxlcnQoMSkvLyZxMj0lMjI+PC9zY3JpcHQ+ Ij4KPC9pZnJhbWU+CjwvYm9keT4KPC9odG1sPgo= 133379 2012-03-22 16:14:31 -0700 2012-03-22 17:07:25 -0700 Patch. patch_81948.txt text/plain 5283 tsepez SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExMTc3OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisyMDEyLTAzLTIyICBUb20gU2Vw ZXogIDx0c2VwZXpAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFhTUyBBdWRpdG9yIGJ5cGFzcyB2 aWEgc2NyaXB0IHRhZyBzcmM9ZGF0YTosIFVSTFMuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD04MTk0OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIFRoaXMgY2hhbmdlIGZpeGVzIGFuIFhTU0F1ZGl0b3IgYnlw YXNzIHdoZXJieSBhIHNjcmlwdCB3aXRoIGEgZGF0YTogVVJMIHNyYworICAgICAgICBhdHRyaWJ1 dGUgY291bGQgZXZhZGUgZGV0ZWN0aW9uIGJ5IHVzaW5nIGNoYXJhY3RlcnMgZnJvbSB0aGUgcGFn ZSB0byBjcmVhdGUKKyAgICAgICAgYSBzbmlwcGV0IGZvciBtYXRjaGluZyBub3QgZm91bmQgaW4g dGhlIFVSTCdzIHJlZmxlY3RlZCB2ZWN0b3IuICBUaGlzIGNoYW5nZSAKKyAgICAgICAgdGVybWlu YXRlcyB0aGUgc25pcHBldCBmb3IgbWF0Y2hpbmcgZWFybGllciBpbiB0aGVzZSBjYXNlcy4KKyAg ICAgICAgCisgICAgICAgIFRlc3Q6IGh0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3Jp cHQtdGFnLXdpdGgtc291cmNlLWRhdGEtdXJsMi5odG1sCisKKyAgICAgICAgKiBodG1sL3BhcnNl ci9YU1NBdWRpdG9yLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlhTU0F1ZGl0b3I6OmRlY29kZWRT bmlwcGV0Rm9yQXR0cmlidXRlKToKKwogMjAxMi0wMy0yMiAgTWljaGFsIE1vY255ICA8bW1vY255 QGdvb2dsZS5jb20+CiAKICAgICAgICAgW2Nocm9taXVtXSBMYXllclJlbmRlcmVyQ2hyb21pdW0g c2hvdWxkIHVzZSBHcHVNZW1vcnlBbGxvY2F0aW9uQ2hhbmdlZCBjYWxsYmFjayB0byBleHBsaWNp dGx5IG1hbmFnZSBmcmFtZWJ1ZmZlci4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2Vy L1hTU0F1ZGl0b3IuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2Vy L1hTU0F1ZGl0b3IuY3BwCShyZXZpc2lvbiAxMTE3NzIpCisrKyBTb3VyY2UvV2ViQ29yZS9odG1s L3BhcnNlci9YU1NBdWRpdG9yLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNTE4LDE1ICs1MTgsMjEg QEAgU3RyaW5nIFhTU0F1ZGl0b3I6OmRlY29kZWRTbmlwcGV0Rm9yQXR0cgogICAgIGlmICh0cmVh dG1lbnQgPT0gU3JjTGlrZUF0dHJpYnV0ZSkgewogICAgICAgICBpbnQgc2xhc2hDb3VudDsKICAg ICAgICAgc2l6ZV90IGN1cnJlbnRMZW5ndGg7Ci0gICAgICAgIC8vIENoYXJhY3RlcnMgZm9sbG93 aW5nIHRoZSBmaXJzdCA/LCAjLCBvciB0aGlyZCBzbGFzaCBtYXkgY29tZSBmcm9tIAotICAgICAg ICAvLyB0aGUgcGFnZSBpdHNlbGYgYW5kIGNhbiBiZSBtZXJlbHkgaWdub3JlZCBieSBhbiBhdHRh Y2tlcidzIHNlcnZlcgotICAgICAgICAvLyB3aGVuIGEgcmVtb3RlIHNjcmlwdCBvciBzY3JpcHQt bGlrZSByZXNvdXJjZSBpcyByZXF1ZXN0ZWQuCi0gICAgICAgIGZvciAoc2xhc2hDb3VudCA9IDAs IGN1cnJlbnRMZW5ndGggPSAwOyBjdXJyZW50TGVuZ3RoIDwgZGVjb2RlZFNuaXBwZXQubGVuZ3Ro KCk7ICsrY3VycmVudExlbmd0aCkgeworICAgICAgICBib29sIGNvbW1hU2VlbjsKKyAgICAgICAg Ly8gSW4gSFRUUCBVUkxzLCBjaGFyYWN0ZXJzIGZvbGxvd2luZyB0aGUgZmlyc3QgPywgIywgb3Ig dGhpcmQgc2xhc2ggbWF5IGNvbWUgZnJvbSAKKyAgICAgICAgLy8gdGhlIHBhZ2UgaXRzZWxmIGFu ZCBjYW4gYmUgbWVyZWx5IGlnbm9yZWQgYnkgYW4gYXR0YWNrZXIncyBzZXJ2ZXIgd2hlbiBhIHJl bW90ZQorICAgICAgICAvLyBzY3JpcHQgb3Igc2NyaXB0LWxpa2UgcmVzb3VyY2UgaXMgcmVxdWVz dGVkLiBJbiBEQVRBIFVSTFMsIHRoZSBwYXlsb2FkIHN0YXJ0cyBhdAorICAgICAgICAvLyB0aGUg Zmlyc3QgY29tbWEsIGFuZCB0aGUgdGhlIGZpcnN0IC8qIG9yIC8vIG1heSBpbnRyb2R1Y2UgYSBj b21tZW50LiBDaGFyYWN0ZXJzCisgICAgICAgIC8vIGZvbGxvd2luZyB0aGlzIG1heSBjb21lIGZy b20gdGhlIHBhZ2UgaXRzZWxmIGFuZCBtYXkgYmUgaWdub3JlZCB3aGVuIHRoZSBzY3JpcHQgaXMK KyAgICAgICAgLy8gZXhlY3V0ZWQuIEZvciBzaW1wbGljaXR5LCB3ZSBkb24ndCBkaWZmZXJlbnRp YXRlIGJhc2VkIG9uIFVSTCBzY2hlbWUsIGFuZCBzdG9wIGF0CisgICAgICAgIC8vIHRoZSBmaXJz dCAjIG9yID8sIHRoZSB0aGlyZCBzbGFzaCwgb3IgdGhlIGZpcnN0IHNsYXNoIG9uY2UgYSBjb21t YSBpcyBzZWVuLgorICAgICAgICBmb3IgKHNsYXNoQ291bnQgPSAwLCBjdXJyZW50TGVuZ3RoID0g MCwgY29tbWFTZWVuID0gZmFsc2U7IGN1cnJlbnRMZW5ndGggPCBkZWNvZGVkU25pcHBldC5sZW5n dGgoKTsgKytjdXJyZW50TGVuZ3RoKSB7CiAgICAgICAgICAgICBpZiAoZGVjb2RlZFNuaXBwZXRb Y3VycmVudExlbmd0aF0gPT0gJz8nIHx8IGRlY29kZWRTbmlwcGV0W2N1cnJlbnRMZW5ndGhdID09 ICcjJwotICAgICAgICAgICAgICAgIHx8ICgoZGVjb2RlZFNuaXBwZXRbY3VycmVudExlbmd0aF0g PT0gJy8nIHx8IGRlY29kZWRTbmlwcGV0W2N1cnJlbnRMZW5ndGhdID09ICdcXCcpICYmICsrc2xh c2hDb3VudCA+IDIpKSB7CisgICAgICAgICAgICAgICAgfHwgKChkZWNvZGVkU25pcHBldFtjdXJy ZW50TGVuZ3RoXSA9PSAnLycgfHwgZGVjb2RlZFNuaXBwZXRbY3VycmVudExlbmd0aF0gPT0gJ1xc JykgJiYgKGNvbW1hU2VlbiB8fCArK3NsYXNoQ291bnQgPiAyKSkpIHsKICAgICAgICAgICAgICAg ICBkZWNvZGVkU25pcHBldC50cnVuY2F0ZShjdXJyZW50TGVuZ3RoKTsKICAgICAgICAgICAgICAg ICBicmVhazsKLSAgICAgICAgICAgIH0KKyAgICAgICAgICAgIH0gZWxzZSBpZiAoZGVjb2RlZFNu aXBwZXRbY3VycmVudExlbmd0aF0gPT0gJywnKQorICAgICAgICAgICAgICAgIGNvbW1hU2VlbiA9 IHRydWU7CiAgICAgICAgIH0KICAgICB9CiAgICAgcmV0dXJuIGRlY29kZWRTbmlwcGV0OwpJbmRl eDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5n ZUxvZwkocmV2aXNpb24gMTExNzc4KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5n IGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTItMDMtMjIgIFRvbSBTZXBleiAgPHRzZXBlekBj aHJvbWl1bS5vcmc+CisKKyAgICAgICAgWFNTIEF1ZGl0b3IgYnlwYXNzIHZpYSBzY3JpcHQgdGFn IHNyYz1kYXRhOiwgVVJMUy4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTgxOTQ4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgQWRkIGEgdGVzdCB0aGF0IGRhdGE6IFVSTHMgY2FuJ3QgYnlwYXNzIHhzc2F1ZGl0 b3Igd2l0aCB0cmFpbGluZyBjb21tZW50cy4KKyAgICAgICAgCisgICAgICAgICogaHR0cC90ZXN0 cy9zZWN1cml0eS94c3NBdWRpdG9yL3NjcmlwdC10YWctd2l0aC1zb3VyY2UtZGF0YS11cmwyLWV4 cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRp dG9yL3NjcmlwdC10YWctd2l0aC1zb3VyY2UtZGF0YS11cmwyLmh0bWw6IEFkZGVkLgorCiAyMDEy LTAzLTIyICBFbWlsIEEgRWtsdW5kICA8ZWFlQGNocm9taXVtLm9yZz4KIAogICAgICAgICBVbnJl dmlld2VkIHJlYmFzZWxpbmUgZm9yIGNocm9taXVtIGxlb3BhcmQuCkluZGV4OiBMYXlvdXRUZXN0 cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXNvdXJjZS1k YXRhLXVybDItZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVz dHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3JpcHQtdGFnLXdpdGgtc291cmNlLWRhdGEtdXJsMi1l eHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3Vy aXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXNvdXJjZS1kYXRhLXVybDItZXhwZWN0ZWQu dHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDMgQEAKK0NPTlNPTEUgTUVTU0FHRTogUmVmdXNl ZCB0byBleGVjdXRlIGEgSmF2YVNjcmlwdCBzY3JpcHQuIFNvdXJjZSBjb2RlIG9mIHNjcmlwdCBm b3VuZCB3aXRoaW4gcmVxdWVzdC4KKworCkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3Nl Y3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXNvdXJjZS1kYXRhLXVybDIuaHRtbAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Iv c2NyaXB0LXRhZy13aXRoLXNvdXJjZS1kYXRhLXVybDIuaHRtbAkocmV2aXNpb24gMCkKKysrIExh eW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3JpcHQtdGFnLXdpdGgt c291cmNlLWRhdGEtdXJsMi5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDE1IEBACis8IURP Q1RZUEUgaHRtbD4KKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy5sYXlvdXRU ZXN0Q29udHJvbGxlcikgeworICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cisg IGxheW91dFRlc3RDb250cm9sbGVyLnNldFhTU0F1ZGl0b3JFbmFibGVkKHRydWUpOworfQorPC9z Y3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxpZnJhbWUgc3JjPSJodHRwOi8vbG9jYWxob3N0Ojgw MDAvc2VjdXJpdHkveHNzQXVkaXRvci9yZXNvdXJjZXMvZWNoby1pbnRlcnRhZy5wbD9jbHV0dGVy PTxiPioqKjwvYj4mcT08c2NyaXB0JTIwc3JjPSUyMmRhdGE6LGFsZXJ0KDEpLy8mcTI9JTIyPjwv c2NyaXB0PiI+Cis8L2lmcmFtZT4KKzwvYm9keT4KKzwvaHRtbD4K 133391 2012-03-22 17:07:25 -0700 2012-03-22 19:13:42 -0700 Patch + style nits. patch_81948.txt text/plain 5540 tsepez SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExMTc3OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisyMDEyLTAzLTIyICBUb20gU2Vw ZXogIDx0c2VwZXpAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFhTUyBBdWRpdG9yIGJ5cGFzcyB2 aWEgc2NyaXB0IHRhZyBzcmM9ZGF0YTosIFVSTFMuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD04MTk0OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIFRoaXMgY2hhbmdlIGZpeGVzIGFuIFhTU0F1ZGl0b3IgYnlw YXNzIHdoZXJieSBhIHNjcmlwdCB3aXRoIGEgZGF0YTogVVJMIHNyYworICAgICAgICBhdHRyaWJ1 dGUgY291bGQgZXZhZGUgZGV0ZWN0aW9uIGJ5IHVzaW5nIGNoYXJhY3RlcnMgZnJvbSB0aGUgcGFn ZSB0byBjcmVhdGUKKyAgICAgICAgYSBzbmlwcGV0IGZvciBtYXRjaGluZyBub3QgZm91bmQgaW4g dGhlIFVSTCdzIHJlZmxlY3RlZCB2ZWN0b3IuICBUaGlzIGNoYW5nZSAKKyAgICAgICAgdGVybWlu YXRlcyB0aGUgc25pcHBldCBmb3IgbWF0Y2hpbmcgZWFybGllciBpbiB0aGVzZSBjYXNlcy4KKyAg ICAgICAgCisgICAgICAgIFRlc3Q6IGh0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3Jp cHQtdGFnLXdpdGgtc291cmNlLWRhdGEtdXJsMi5odG1sCisKKyAgICAgICAgKiBodG1sL3BhcnNl ci9YU1NBdWRpdG9yLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlhTU0F1ZGl0b3I6OmRlY29kZWRT bmlwcGV0Rm9yQXR0cmlidXRlKToKKwogMjAxMi0wMy0yMiAgTWljaGFsIE1vY255ICA8bW1vY255 QGdvb2dsZS5jb20+CiAKICAgICAgICAgW2Nocm9taXVtXSBMYXllclJlbmRlcmVyQ2hyb21pdW0g c2hvdWxkIHVzZSBHcHVNZW1vcnlBbGxvY2F0aW9uQ2hhbmdlZCBjYWxsYmFjayB0byBleHBsaWNp dGx5IG1hbmFnZSBmcmFtZWJ1ZmZlci4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2Vy L1hTU0F1ZGl0b3IuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2Vy L1hTU0F1ZGl0b3IuY3BwCShyZXZpc2lvbiAxMTE3NzIpCisrKyBTb3VyY2UvV2ViQ29yZS9odG1s L3BhcnNlci9YU1NBdWRpdG9yLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNTE2LDE3ICs1MTYsMjMg QEAgU3RyaW5nIFhTU0F1ZGl0b3I6OmRlY29kZWRTbmlwcGV0Rm9yQXR0cgogICAgIFN0cmluZyBk ZWNvZGVkU25pcHBldCA9IGZ1bGx5RGVjb2RlU3RyaW5nKG1fcGFyc2VyLT5zb3VyY2VGb3JUb2tl bih0b2tlbikuc3Vic3RyaW5nKHN0YXJ0LCBlbmQgLSBzdGFydCksIG1fcGFyc2VyLT5kb2N1bWVu dCgpLT5kZWNvZGVyKCkpOwogICAgIGRlY29kZWRTbmlwcGV0LnRydW5jYXRlKGtNYXhpbXVtRnJh Z21lbnRMZW5ndGhUYXJnZXQpOwogICAgIGlmICh0cmVhdG1lbnQgPT0gU3JjTGlrZUF0dHJpYnV0 ZSkgewotICAgICAgICBpbnQgc2xhc2hDb3VudDsKLSAgICAgICAgc2l6ZV90IGN1cnJlbnRMZW5n dGg7Ci0gICAgICAgIC8vIENoYXJhY3RlcnMgZm9sbG93aW5nIHRoZSBmaXJzdCA/LCAjLCBvciB0 aGlyZCBzbGFzaCBtYXkgY29tZSBmcm9tIAotICAgICAgICAvLyB0aGUgcGFnZSBpdHNlbGYgYW5k IGNhbiBiZSBtZXJlbHkgaWdub3JlZCBieSBhbiBhdHRhY2tlcidzIHNlcnZlcgotICAgICAgICAv LyB3aGVuIGEgcmVtb3RlIHNjcmlwdCBvciBzY3JpcHQtbGlrZSByZXNvdXJjZSBpcyByZXF1ZXN0 ZWQuCi0gICAgICAgIGZvciAoc2xhc2hDb3VudCA9IDAsIGN1cnJlbnRMZW5ndGggPSAwOyBjdXJy ZW50TGVuZ3RoIDwgZGVjb2RlZFNuaXBwZXQubGVuZ3RoKCk7ICsrY3VycmVudExlbmd0aCkgewot ICAgICAgICAgICAgaWYgKGRlY29kZWRTbmlwcGV0W2N1cnJlbnRMZW5ndGhdID09ICc/JyB8fCBk ZWNvZGVkU25pcHBldFtjdXJyZW50TGVuZ3RoXSA9PSAnIycKLSAgICAgICAgICAgICAgICB8fCAo KGRlY29kZWRTbmlwcGV0W2N1cnJlbnRMZW5ndGhdID09ICcvJyB8fCBkZWNvZGVkU25pcHBldFtj dXJyZW50TGVuZ3RoXSA9PSAnXFwnKSAmJiArK3NsYXNoQ291bnQgPiAyKSkgeworICAgICAgICBp bnQgc2xhc2hDb3VudCA9IDA7CisgICAgICAgIGJvb2wgY29tbWFTZWVuID0gZmFsc2U7CisgICAg ICAgIC8vIEluIEhUVFAgVVJMcywgY2hhcmFjdGVycyBmb2xsb3dpbmcgdGhlIGZpcnN0ID8sICMs IG9yIHRoaXJkIHNsYXNoIG1heSBjb21lIGZyb20gCisgICAgICAgIC8vIHRoZSBwYWdlIGl0c2Vs ZiBhbmQgY2FuIGJlIG1lcmVseSBpZ25vcmVkIGJ5IGFuIGF0dGFja2VyJ3Mgc2VydmVyIHdoZW4g YSByZW1vdGUKKyAgICAgICAgLy8gc2NyaXB0IG9yIHNjcmlwdC1saWtlIHJlc291cmNlIGlzIHJl cXVlc3RlZC4gSW4gREFUQSBVUkxTLCB0aGUgcGF5bG9hZCBzdGFydHMgYXQKKyAgICAgICAgLy8g dGhlIGZpcnN0IGNvbW1hLCBhbmQgdGhlIHRoZSBmaXJzdCAvKiBvciAvLyBtYXkgaW50cm9kdWNl IGEgY29tbWVudC4gQ2hhcmFjdGVycworICAgICAgICAvLyBmb2xsb3dpbmcgdGhpcyBtYXkgY29t ZSBmcm9tIHRoZSBwYWdlIGl0c2VsZiBhbmQgbWF5IGJlIGlnbm9yZWQgd2hlbiB0aGUgc2NyaXB0 IGlzCisgICAgICAgIC8vIGV4ZWN1dGVkLiBGb3Igc2ltcGxpY2l0eSwgd2UgZG9uJ3QgZGlmZmVy ZW50aWF0ZSBiYXNlZCBvbiBVUkwgc2NoZW1lLCBhbmQgc3RvcCBhdAorICAgICAgICAvLyB0aGUg Zmlyc3QgIyBvciA/LCB0aGUgdGhpcmQgc2xhc2gsIG9yIHRoZSBmaXJzdCBzbGFzaCBvbmNlIGEg Y29tbWEgaXMgc2Vlbi4KKyAgICAgICAgZm9yIChzaXplX3QgY3VycmVudExlbmd0aCA9IDA7IGN1 cnJlbnRMZW5ndGggPCBkZWNvZGVkU25pcHBldC5sZW5ndGgoKTsgKytjdXJyZW50TGVuZ3RoKSB7 CisgICAgICAgICAgICBVQ2hhciBjdXJyZW50Q2hhciA9IGRlY29kZWRTbmlwcGV0W2N1cnJlbnRM ZW5ndGhdOworICAgICAgICAgICAgaWYgKGN1cnJlbnRDaGFyID09ICc/JyB8fCBjdXJyZW50Q2hh ciA9PSAnIycgfHwgKChjdXJyZW50Q2hhciA9PSAnLycgfHwgY3VycmVudENoYXIgPT0gJ1xcJykg JiYgKGNvbW1hU2VlbiB8fCArK3NsYXNoQ291bnQgPiAyKSkpIHsKICAgICAgICAgICAgICAgICBk ZWNvZGVkU25pcHBldC50cnVuY2F0ZShjdXJyZW50TGVuZ3RoKTsKICAgICAgICAgICAgICAgICBi cmVhazsKICAgICAgICAgICAgIH0KKyAgICAgICAgICAgIGlmIChjdXJyZW50Q2hhciA9PSAnLCcp CisgICAgICAgICAgICAgICAgY29tbWFTZWVuID0gdHJ1ZTsKICAgICAgICAgfQogICAgIH0KICAg ICByZXR1cm4gZGVjb2RlZFNuaXBwZXQ7CkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lvbiAxMTE3NzgpCisrKyBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxNSBAQAorMjAx Mi0wMy0yMiAgVG9tIFNlcGV6ICA8dHNlcGV6QGNocm9taXVtLm9yZz4KKworICAgICAgICBYU1Mg QXVkaXRvciBieXBhc3MgdmlhIHNjcmlwdCB0YWcgc3JjPWRhdGE6LCBVUkxTLgorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9ODE5NDgKKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQgYSB0ZXN0IHRoYXQgZGF0 YTogVVJMcyBjYW4ndCBieXBhc3MgeHNzYXVkaXRvciB3aXRoIHRyYWlsaW5nIGNvbW1lbnRzLgor ICAgICAgICAKKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0 LXRhZy13aXRoLXNvdXJjZS1kYXRhLXVybDItZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAg KiBodHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXNvdXJjZS1k YXRhLXVybDIuaHRtbDogQWRkZWQuCisKIDIwMTItMDMtMjIgIEVtaWwgQSBFa2x1bmQgIDxlYWVA Y2hyb21pdW0ub3JnPgogCiAgICAgICAgIFVucmV2aWV3ZWQgcmViYXNlbGluZSBmb3IgY2hyb21p dW0gbGVvcGFyZC4KSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVk aXRvci9zY3JpcHQtdGFnLXdpdGgtc291cmNlLWRhdGEtdXJsMi1leHBlY3RlZC50eHQKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL3Njcmlw dC10YWctd2l0aC1zb3VyY2UtZGF0YS11cmwyLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysr IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3JpcHQtdGFnLXdp dGgtc291cmNlLWRhdGEtdXJsMi1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEs MyBAQAorQ09OU09MRSBNRVNTQUdFOiBSZWZ1c2VkIHRvIGV4ZWN1dGUgYSBKYXZhU2NyaXB0IHNj cmlwdC4gU291cmNlIGNvZGUgb2Ygc2NyaXB0IGZvdW5kIHdpdGhpbiByZXF1ZXN0LgorCisKSW5k ZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3JpcHQtdGFn LXdpdGgtc291cmNlLWRhdGEtdXJsMi5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0 dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3JpcHQtdGFnLXdpdGgtc291cmNlLWRhdGEt dXJsMi5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0 eS94c3NBdWRpdG9yL3NjcmlwdC10YWctd2l0aC1zb3VyY2UtZGF0YS11cmwyLmh0bWwJKHJldmlz aW9uIDApCkBAIC0wLDAgKzEsMTUgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8aGVhZD4K KzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKSB7CisgIGxheW91dFRl c3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgbGF5b3V0VGVzdENvbnRyb2xsZXIuc2V0WFNT QXVkaXRvckVuYWJsZWQodHJ1ZSk7Cit9Cis8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5PgorPGlm cmFtZSBzcmM9Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9zZWN1cml0eS94c3NBdWRpdG9yL3Jlc291 cmNlcy9lY2hvLWludGVydGFnLnBsP2NsdXR0ZXI9PGI+KioqPC9iPiZxPTxzY3JpcHQlMjBzcmM9 JTIyZGF0YTosYWxlcnQoMSkvLyZxMj0lMjI+PC9zY3JpcHQ+Ij4KKzwvaWZyYW1lPgorPC9ib2R5 PgorPC9odG1sPgo=