88461 2012-06-06 15:13:41 -0700 Access control allow lists starting with a comma are parsed incorrectly (CORS) 2012-06-10 13:18:58 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 0 pf webkit-unassigned abarth annevk ap japhet jochen odinho webkit.review.bot oldest_to_newest 642868 0 pf 2012-06-06 15:13:41 -0700 For example: Access-Control-Allow-Headers: ,blah,bleh The parsing algorithm will stop parsing at the first comma, and the whole header will be effectively ignored. 642890 1 146126 pf 2012-06-06 15:31:01 -0700 Created attachment 146126 Patch 642900 2 ap 2012-06-06 15:37:08 -0700 Could you please explain why our behavior is incorrect? Are "empty entries" allowed here? 642919 3 pf 2012-06-06 15:57:32 -0700 (In reply to comment #2) > Could you please explain why our behavior is incorrect? Are "empty entries" allowed here? Yeah, sorry, the http spec says that lists in headers are separated by one or more commas (perhaps empty entries was a misnomer on my part). Firefox and Opera behave like this. 643975 4 146126 abarth 2012-06-07 15:20:38 -0700 Comment on attachment 146126 Patch Which spec says you're allowed to have commas in this header? CORS refers to http://tools.ietf.org/html/rfc6454#section-7.1 which indicates that the origins are separated by spaces, not by commas. 643984 5 pf 2012-06-07 15:28:29 -0700 (In reply to comment #4) > (From update of attachment 146126 [details]) > Which spec says you're allowed to have commas in this header? CORS refers to http://tools.ietf.org/html/rfc6454#section-7.1 which indicates that the origins are separated by spaces, not by commas. http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html#access-control-allow-headers-response-header Access-Control-Allow-Headers: "Access-Control-Allow-Headers" ":" #field-name field-name points to rfc-2616. http://tools.ietf.org/html/rfc2616#page-15 #rule A construct "#" is defined, similar to "*", for defining lists of elements. The full form is "<n>#<m>element" indicating at least <n> and at most <m> elements, each separated by one or more commas (",") and OPTIONAL linear white space (LWS). This makes the usual form of lists very easy; a rule such as ( *LWS element *( *LWS "," *LWS element )) can be shown as 1#element Wherever this construct is used, null elements are allowed, but do not contribute to the count of elements present. That is, "(element), , (element) " is permitted, but counts as only two elements. Therefore, where at least one element is required, at least one non-null element MUST be present. Default values are 0 and infinity so that "#element" allows any number, including zero; "1#element" requires at least one; and "1#2element" allows one or two. 644093 6 abarth 2012-06-07 17:06:01 -0700 Ah, my mistake! I thought you were referring to Access-Control-Allow-Origin. 644101 7 abarth 2012-06-07 17:11:56 -0700 Doesn't ( *LWS element *( *LWS "," *LWS element )) require at least one element to precede the first comma? first-header: , foo, bar second-header: foo,, bar It sounds like first-header is invalid but second-header is valid. Maybe I'm still not quite understanding. 645006 8 pf 2012-06-08 13:50:54 -0700 (In reply to comment #7) > Doesn't ( *LWS element *( *LWS "," *LWS element )) require at least one element to precede the first comma? > > first-header: , foo, bar > second-header: foo,, bar > > It sounds like first-header is invalid but second-header is valid. Maybe I'm still not quite understanding. Yeah, i'd say the first one is invalid per the definition. It works in Firefox and Opera, though. The second one doesn't work with the current code either. Would you prefer the first case to remain invalid? 645012 9 abarth 2012-06-08 14:04:20 -0700 If it works in Firefox and Opera, then perhaps we should follow suit. 645269 10 annevk 2012-06-09 01:36:07 -0700 Per http://tools.ietf.org/html/rfc2616#section-2.1 null elements are allowed (with some constraints). 645375 11 abarth 2012-06-09 11:45:41 -0700 (In reply to comment #10) > Per http://tools.ietf.org/html/rfc2616#section-2.1 null elements are allowed (with some constraints). Anne, I think the question we're trying to resolve is whether to allow an empty element in the first position. RFC 2616 seems to say that's not allowed, but Firefox and Opera seem to allow it. Specifically, this is the case we're wondering about: first-header: , foo, bar 645453 12 annevk 2012-06-09 23:41:43 -0700 Where does it say that is not allowed? The prose I pointed to seems to allow that. 645601 13 abarth 2012-06-10 12:26:10 -0700 (In reply to comment #12) > Where does it say that is not allowed? The prose I pointed to seems to allow that. Yes. You're right (as usual). :) 645613 14 146126 webkit.review.bot 2012-06-10 13:18:53 -0700 Comment on attachment 146126 Patch Clearing flags on attachment: 146126 Committed r119945: <http://trac.webkit.org/changeset/119945> 645614 15 webkit.review.bot 2012-06-10 13:18:58 -0700 All reviewed patches have been landed. Closing bug. 146126 2012-06-06 15:31:01 -0700 2012-06-10 13:18:53 -0700 Patch bug-88461-20120606153101.patch text/plain 6413 pf U3VidmVyc2lvbiBSZXZpc2lvbjogMTE2NjkxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMmVlMjkwNTEwNWQ5MzY0 ZDViY2Y3N2Q5N2E1NGE0ZTFhMDJiMWE4NS4uNTIzNGVjNWE4OGI4ZDQ2Y2JlNjQ5ZGJmMGY0MjU3 YTM5YmU5NDI4MiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDEyLTA2LTA2ICBQYWJs byBGbG91cmV0ICA8cGFibG9mQG1vdG9yb2xhLmNvbT4KKworICAgICAgICBBY2Nlc3MgY29udHJv bCBhbGxvdyBsaXN0cyBzdGFydGluZyB3aXRoIGEgY29tbWEgYXJlIHBhcnNlZCBpbmNvcnJlY3Rs eSAoQ09SUykKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTg4NDYxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg VGhlIHBhcnNpbmcgYWxnb3JpdGhtIHdvdWxkIHN0b3AgcGFyc2luZyBhdCB0aGUgZmlyc3QgY29t bWEgKGJlaW5nIGFuCisgICAgICAgIGVtcHR5IGVudHJ5LCBvZiBzb3J0cykgYW5kIGJhaWwgb3V0 LCBlZmZlY3RpdmVseSBpZ25vcmluZyB0aGUgd2hvbGUKKyAgICAgICAgaGVhZGVyLgorCisgICAg ICAgIFRlc3Q6IGh0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNzLWNvbnRyb2wtYWxsb3ct bGlzdHMtc3RhcnRpbmctd2l0aC1jb21tYS5odG1sCisKKyAgICAgICAgKiBsb2FkZXIvQ3Jvc3NP cmlnaW5QcmVmbGlnaHRSZXN1bHRDYWNoZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpwYXJzZUFj Y2Vzc0NvbnRyb2xBbGxvd0xpc3QpOgorCiAyMDEyLTA2LTA0ICBQYWJsbyBGbG91cmV0ICA8cGFi bG9mQG1vdG9yb2xhLmNvbT4KIAogICAgICAgICBUaGUgdmFsdWUgaW4gQWNjZXNzLUNvbnRyb2wt QWxsb3ctT3JpZ2luIGlzIG5vdCBiZWluZyBtYXRjaGVkIGNvcnJlY3RseSBmb3IgQ09SUy1lbmFi bGVkIHJlcXVlc3RzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvQ3Jvc3NPcmln aW5QcmVmbGlnaHRSZXN1bHRDYWNoZS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvQ3Jvc3NP cmlnaW5QcmVmbGlnaHRSZXN1bHRDYWNoZS5jcHAKaW5kZXggMTk4ZGRhZmEzYzdjNjcyOTU4MjVm MGE2OGI4MmM3OGIwMDQ4Nzk4ZS4uMDRkNTg4MTU1Y2U1NTMzYmRkZDNmMDJiM2JkODE1ZWQ5ZWUz OTllYiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL0Nyb3NzT3JpZ2luUHJlZmxp Z2h0UmVzdWx0Q2FjaGUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9Dcm9zc09yaWdp blByZWZsaWdodFJlc3VsdENhY2hlLmNwcApAQCAtNzcsMTAgKzc3LDggQEAgc3RhdGljIGJvb2wg cGFyc2VBY2Nlc3NDb250cm9sQWxsb3dMaXN0KGNvbnN0IFN0cmluZyYgc3RyaW5nLCBIYXNoU2V0 PFN0cmluZywgSGEKICAgICB1bnNpZ25lZCBzdGFydCA9IDA7CiAgICAgc2l6ZV90IGVuZDsKICAg ICB3aGlsZSAoKGVuZCA9IHN0cmluZy5maW5kKCcsJywgc3RhcnQpKSAhPSBub3RGb3VuZCkgewot ICAgICAgICBpZiAoc3RhcnQgPT0gZW5kKQotICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwotCi0g ICAgICAgIGFkZFRvQWNjZXNzQ29udHJvbEFsbG93TGlzdChzdHJpbmcsIHN0YXJ0LCBlbmQgLSAx LCBzZXQpOworICAgICAgICBpZiAoc3RhcnQgIT0gZW5kKQorICAgICAgICAgICAgYWRkVG9BY2Nl c3NDb250cm9sQWxsb3dMaXN0KHN0cmluZywgc3RhcnQsIGVuZCAtIDEsIHNldCk7CiAgICAgICAg IHN0YXJ0ID0gZW5kICsgMTsKICAgICB9CiAgICAgaWYgKHN0YXJ0ICE9IHN0cmluZy5sZW5ndGgo KSkKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5n ZUxvZwppbmRleCBhN2Q5NTM1MjI1NDhjZGM4Yjc4YTE4YTFlMzI1ZTM5ZTkzOWNjMDliLi4zZTg5 NzZmYjI4N2Y4NDUxYTQ0NmIyYzljN2FiNzdkN2I1NWY5OWQ1IDEwMDY0NAotLS0gYS9MYXlvdXRU ZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQg QEAKKzIwMTItMDYtMDYgIFBhYmxvIEZsb3VyZXQgIDxwYWJsb2ZAbW90b3JvbGEuY29tPgorCisg ICAgICAgIEFjY2VzcyBjb250cm9sIGFsbG93IGxpc3RzIHN0YXJ0aW5nIHdpdGggYSBjb21tYSBh cmUgcGFyc2VkIGluY29ycmVjdGx5IChDT1JTKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9ODg0NjEKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICAqIGh0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNzLWNv bnRyb2wtYWxsb3ctbGlzdHMtc3RhcnRpbmctd2l0aC1jb21tYS1leHBlY3RlZC50eHQ6IEFkZGVk LgorICAgICAgICAqIGh0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNzLWNvbnRyb2wtYWxs b3ctbGlzdHMtc3RhcnRpbmctd2l0aC1jb21tYS5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBodHRw L3Rlc3RzL3htbGh0dHByZXF1ZXN0L3Jlc291cmNlcy9hY2Nlc3MtY29udHJvbC1hbGxvdy1saXN0 cy5waHA6IEFkZGVkLgorCiAyMDEyLTA2LTA0ICBQYWJsbyBGbG91cmV0ICA8cGFibG9mQG1vdG9y b2xhLmNvbT4KIAogICAgICAgICBUaGUgdmFsdWUgaW4gQWNjZXNzLUNvbnRyb2wtQWxsb3ctT3Jp Z2luIGlzIG5vdCBiZWluZyBtYXRjaGVkIGNvcnJlY3RseSBmb3IgQ09SUy1lbmFibGVkIHJlcXVl c3RzCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L2Fj Y2Vzcy1jb250cm9sLWFsbG93LWxpc3RzLXN0YXJ0aW5nLXdpdGgtY29tbWEtZXhwZWN0ZWQudHh0 IGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy94bWxodHRwcmVxdWVzdC9hY2Nlc3MtY29udHJvbC1h bGxvdy1saXN0cy1zdGFydGluZy13aXRoLWNvbW1hLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2Rl IDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi4w ZGRiMTZkN2Q3ZDNhYmRiMTM5MmM1MWQ0NjA4MjEzMGU5YzE2ZGMxCi0tLSAvZGV2L251bGwKKysr IGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy94bWxodHRwcmVxdWVzdC9hY2Nlc3MtY29udHJvbC1h bGxvdy1saXN0cy1zdGFydGluZy13aXRoLWNvbW1hLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDE1 IEBACitBbGxvdyBsaXN0cyBzdGFydGluZyB3aXRoIGEgY29tbWEgc2hvdWxkIGJlIHBhcnNlZCBj b3JyZWN0bHkuCisKK09uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIg bWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKworCitTZW5kaW5nIEdFVCBy ZXF1ZXN0IHdpdGggY3VzdG9tIGhlYWRlcnMuCitQQVNTIHhoci5zZW5kKG51bGwpIGlzIHVuZGVm aW5lZC4KK1BBU1MgcmVzcG9uc2VbJ3gtcHJpbnQnXSBpcyAidW5pY29ybiIKK1BBU1MgcmVzcG9u c2VbJ3ktcHJpbnQnXSBpcyAibmFyd2hhbCIKK1NlbmRpbmcgUFVUIHJlcXVlc3QuCitQQVNTIHho ci5zZW5kKG51bGwpIGlzIHVuZGVmaW5lZC4KK1BBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2VkIGlzIHRy dWUKKworVEVTVCBDT01QTEVURQorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9odHRwL3Rlc3Rz L3htbGh0dHByZXF1ZXN0L2FjY2Vzcy1jb250cm9sLWFsbG93LWxpc3RzLXN0YXJ0aW5nLXdpdGgt Y29tbWEuaHRtbCBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNz LWNvbnRyb2wtYWxsb3ctbGlzdHMtc3RhcnRpbmctd2l0aC1jb21tYS5odG1sCm5ldyBmaWxlIG1v ZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAu LmE0YmZlZTMzNmJhNmYxYTY5MmRmODAwMjc3NGY1MDZiNmFmMGIxOTYKLS0tIC9kZXYvbnVsbAor KysgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L2FjY2Vzcy1jb250cm9s LWFsbG93LWxpc3RzLXN0YXJ0aW5nLXdpdGgtY29tbWEuaHRtbApAQCAtMCwwICsxLDI3IEBACis8 IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0IHNyYz0iLi4vLi4vanMtdGVz dC1yZXNvdXJjZXMvanMtdGVzdC1wcmUuanMiPjwvc2NyaXB0PgorPC9oZWFkPgorPGJvZHk+Cis8 c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCI+CitkZXNjcmlwdGlvbigiQWxsb3cgbGlzdHMg c3RhcnRpbmcgd2l0aCBhIGNvbW1hIHNob3VsZCBiZSBwYXJzZWQgY29ycmVjdGx5LiIpOwordmFy IHhociA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOwordmFyIHVybCA9ICJodHRwOi8vbG9jYWxob3N0 OjgwMDAveG1saHR0cHJlcXVlc3QvcmVzb3VyY2VzL2FjY2Vzcy1jb250cm9sLWFsbG93LWxpc3Rz LnBocD9oZWFkZXJzPSx5LWxvbCx4LXByaW50LCUyMCwsLHktcHJpbnQiOworeGhyLm9wZW4oIkdF VCIsIHVybCwgZmFsc2UpOworeGhyLnNldFJlcXVlc3RIZWFkZXIoJ3gtcHJpbnQnLCAndW5pY29y bicpCit4aHIuc2V0UmVxdWVzdEhlYWRlcigneS1wcmludCcsICduYXJ3aGFsJykKK2RlYnVnKCJT ZW5kaW5nIEdFVCByZXF1ZXN0IHdpdGggY3VzdG9tIGhlYWRlcnMuIik7CitzaG91bGRCZVVuZGVm aW5lZCgieGhyLnNlbmQobnVsbCkiKTsKK3ZhciByZXNwb25zZSA9IEpTT04ucGFyc2UoeGhyLnJl c3BvbnNlKQorc2hvdWxkQmVFcXVhbFRvU3RyaW5nKCJyZXNwb25zZVsneC1wcmludCddIiwgInVu aWNvcm4iKTsKK3Nob3VsZEJlRXF1YWxUb1N0cmluZygicmVzcG9uc2VbJ3ktcHJpbnQnXSIsICJu YXJ3aGFsIik7CisKK3VybCA9ICJodHRwOi8vbG9jYWxob3N0OjgwMDAveG1saHR0cHJlcXVlc3Qv cmVzb3VyY2VzL2FjY2Vzcy1jb250cm9sLWFsbG93LWxpc3RzLnBocD9tZXRob2RzPSwsUFVULEdF VCI7Cit4aHIub3BlbigiUFVUIiwgdXJsLCBmYWxzZSk7CitkZWJ1ZygiU2VuZGluZyBQVVQgcmVx dWVzdC4iKTsKK3Nob3VsZEJlVW5kZWZpbmVkKCJ4aHIuc2VuZChudWxsKSIpOworPC9zY3JpcHQ+ Cis8c2NyaXB0IHNyYz0iLi4vLi4vanMtdGVzdC1yZXNvdXJjZXMvanMtdGVzdC1wb3N0LmpzIj48 L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAv dGVzdHMveG1saHR0cHJlcXVlc3QvcmVzb3VyY2VzL2FjY2Vzcy1jb250cm9sLWFsbG93LWxpc3Rz LnBocCBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvcmVzb3VyY2VzL2Fj Y2Vzcy1jb250cm9sLWFsbG93LWxpc3RzLnBocApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi40Nzk1MjM0M2I1MWUwM2Mz ZDUxYzcwYjNhNDFlOGZhOGQ3MGM2YjBiCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMv aHR0cC90ZXN0cy94bWxodHRwcmVxdWVzdC9yZXNvdXJjZXMvYWNjZXNzLWNvbnRyb2wtYWxsb3ct bGlzdHMucGhwCkBAIC0wLDAgKzEsMjggQEAKKzw/cGhwCisKKyRvcmlnaW4gPSBpc3NldCgkX0dF VFsnb3JpZ2luJ10pID8gJF9HRVRbJ29yaWdpbiddIDogJF9TRVJWRVJbJ0hUVFBfT1JJR0lOJ107 CisKK2lmICgkb3JpZ2luICE9ICdub25lJykKKyAgICBoZWFkZXIoIkFjY2Vzcy1Db250cm9sLUFs bG93LU9yaWdpbjogJG9yaWdpbiIpOworCitpZiAoaXNzZXQoJF9HRVRbJ2hlYWRlcnMnXSkpCisg ICAgaGVhZGVyKCJBY2Nlc3MtQ29udHJvbC1BbGxvdy1IZWFkZXJzOiB7JF9HRVRbJ2hlYWRlcnMn XX0iKTsKK2lmIChpc3NldCgkX0dFVFsnbWV0aG9kcyddKSkKKyAgICBoZWFkZXIoIkFjY2Vzcy1D b250cm9sLUFsbG93LU1ldGhvZHM6IHskX0dFVFsnbWV0aG9kcyddfSIpOworCitmb3JlYWNoICgk X1NFUlZFUiBhcyAkbmFtZSA9PiAkdmFsdWUpCit7CisgICAgaWYgKHN1YnN0cigkbmFtZSwgMCwg NSkgPT0gJ0hUVFBfJykKKyAgICB7CisgICAgICAgICRuYW1lID0gc3RydG9sb3dlcihzdHJfcmVw bGFjZSgnXycsICctJywgc3Vic3RyKCRuYW1lLCA1KSkpOworICAgICAgICAkaGVhZGVyc1skbmFt ZV0gPSAkdmFsdWU7CisgICAgfSBlbHNlIGlmICgkbmFtZSA9PSAiQ09OVEVOVF9UWVBFIikgewor ICAgICAgICAkaGVhZGVyc1siY29udGVudC10eXBlIl0gPSAkdmFsdWU7CisgICAgfSBlbHNlIGlm ICgkbmFtZSA9PSAiQ09OVEVOVF9MRU5HVEgiKSB7CisgICAgICAgICRoZWFkZXJzWyJjb250ZW50 LWxlbmd0aCJdID0gJHZhbHVlOworICAgIH0KK30KKworJGhlYWRlcnNbJ2dldF92YWx1ZSddID0g aXNzZXQoJF9HRVRbJ2dldF92YWx1ZSddKSA/ICRfR0VUWydnZXRfdmFsdWUnXSA6ICcnOworCitl Y2hvIGpzb25fZW5jb2RlKCAkaGVhZGVycyApOwo=