Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kUTqw-0005Zt-RX for pgadmin-hackers@arkaria.postgresql.org; Mon, 19 Oct 2020 12:01:27 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kUTqv-0001bO-OH for pgadmin-hackers@arkaria.postgresql.org; Mon, 19 Oct 2020 12:01:25 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kUTqv-0001bG-G3 for pgadmin-hackers@lists.postgresql.org; Mon, 19 Oct 2020 12:01:25 +0000 Received: from mail-pj1-x102b.google.com ([2607:f8b0:4864:20::102b]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1kUTqr-0003Zq-0U for pgadmin-hackers@postgresql.org; Mon, 19 Oct 2020 12:01:24 +0000 Received: by mail-pj1-x102b.google.com with SMTP id p21so5210545pju.0 for ; Mon, 19 Oct 2020 05:01:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=i9LLi5novZE4+FbPLhhHq7Z0i59R7MT5iImQWVj+x9k=; b=SYw0e2Tz3Ac+0IL72G6JvbJvsjbiHSOW5LpLquyTpWPfMaCZuAL8mCNhKe6Xvikg5N rCJeMlslmpKqIcKZwwDHeIH78VMNpyEHSc7Dh9TFN3ymaWevUZu+lRlzFwShHDaZgSGl bgb4cwfUi4xZdpt6rKQcJSg/sflXmClBbkYZRNpL9AUrT/AVuKmAbSilY1scmDKJ3SFG S2adTovBjOtE2AtL3w+4ezu86DLpe83Prho4ORtWG75UF3mIPBc55mqOUds30YO1HUtF Ck+AgcxL/aTGvJWEKZTDECDOwVwhuN8fEn98fSqCBBCFD4ce68OFc3vcur7m4RoZWMRq 2pGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=i9LLi5novZE4+FbPLhhHq7Z0i59R7MT5iImQWVj+x9k=; b=XG2mWVw5VLJcZDt9ONca2lhX8qPFrV+OiZs7WxdBbdFxED74Hqd6jOodwFwQJstSB3 bqkM78B6EgSIjTNgHclG565HEfyK94guoOOtpgOBJ3Nus0BEmteEc2e1q/RKlH0S6JlP 29u6Rkg+fZ89/MU+l0ATfK+zN1/PMQM6yzYF6i3YAzuJ7k1SzHktobf20qLovD7MZQh5 nt0ni6zBYuay9m775yh84QcdO27Ewrh+pGWdeWbgHgwExU1Pyo7PzDoZ5IwtzEJqEgq3 i6hUdwE4mQiA7iO50iW+xajWXYuj+sOkAJwVVO3Sc2s9IXLy4Vp+Sn8u1QVRgTf7X+FY sDhw== X-Gm-Message-State: AOAM532LYeSze6N1fOIDbsYw7u5lMCU13vzWTgVWa119T5WNwMntPUsh lb48kYeVjGfuS697vPbcDOoxDuETh7Pzl0Z1a6axhK7n4Ue3Ck+saRpigmMeWsJ3J8K8jPLvZOd zkyiBdvP6wQDFGHCxP96Gz/ceye/cW2iQbcuw0Vp3mhZDiWyt+s9qmZEz8jwWVTsmjr1bSJ8NXi hvfojAGbjqbwfnrqxag532s/y1RZ6jgPL9DnJAl9tKogxugO8bfFDB7pA2gCLYoNAbHyIZAGk= X-Google-Smtp-Source: ABdhPJwthzw2bLZ8m2PK+LV/tEwsJSP/bD4mGLPgirV1lHQeUR07ISW43MpdPpN4cHfF+/u23fq/GiqOC7npXuoNDGs= X-Received: by 2002:a17:90a:1704:: with SMTP id z4mr16763292pjd.7.1603108878125; Mon, 19 Oct 2020 05:01:18 -0700 (PDT) MIME-Version: 1.0 From: Ganesh Jaybhay Date: Mon, 19 Oct 2020 17:31:07 +0530 Message-ID: Subject: [pgAdmin][5919] Fix security related issues To: pgadmin-hackers Content-Type: multipart/mixed; boundary="00000000000037bc7305b204dfd9" X-CLOUD-SEC-AV-Info: enterprisedb,google_mail,monitor X-CLOUD-SEC-AV-Sent: true X-Gm-Spam: 0 X-Gm-Phishy: 0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --00000000000037bc7305b204dfd9 Content-Type: multipart/alternative; boundary="00000000000037bc7205b204dfd7" --00000000000037bc7205b204dfd7 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Hackers, Please find the attached patch to fix the below security issues: - Host Header Injection - Added ALLOWED_HOSTS list to limit host address - Lack of Content Security Policy (CSP) - Added security header - Lack of Protection Mechanisms - HSTS - Added security header - Lack of Cookie Attribute =E2=80=93 Secure : Kept as False as secure li= mits cookies to HTTPS traffic only. - Information Disclosure =E2=80=93 Web Server / Development Framework VersionDescription: Kept as hard coded 'Python' instead of exposing wsgi/python/gunicorn version info. Please review and let me know if I have missed anything. Regards, Ganesh Jaybhay --00000000000037bc7205b204dfd7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Hackers,

Please find the attached pa= tch to fix the below security issues:
  • Host Header Injecti= on -=C2=A0Added ALLOWED_HOSTS list to limit host address=C2=A0
  • Lack= of Content Security Policy (CSP) - Added security header
  • Lack of P= rotection Mechanisms - HSTS -=C2=A0Added security header
  • Lack of Co= okie Attribute =E2=80=93 Secure : Kept as False as secure limits cookies to= HTTPS traffic only.
  • Information Disclosure =E2=80=93 Web Server / = Development Framework VersionDescription: Kept=C2=A0as hard coded 'Pyth= on' instead of exposing wsgi/python/gunicorn version info.
Please review and let me know if I have missed anything.
=
Regards,
Ganesh Jaybhay

--00000000000037bc7205b204dfd7-- --00000000000037bc7305b204dfd9 Content-Type: application/octet-stream; name="RM5919.patch" Content-Disposition: attachment; filename="RM5919.patch" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_kgghltfw0 ZGlmZiAtLWdpdCBhL0RvY2tlcmZpbGUgYi9Eb2NrZXJmaWxlCmluZGV4IDM4YzEzMTAuLjNmNWQ1 MDQgMTAwNjQ0Ci0tLSBhL0RvY2tlcmZpbGUKKysrIGIvRG9ja2VyZmlsZQpAQCAtODEsNyArODEs OCBAQCBSVU4gYXBrIGFkZCAtLW5vLWNhY2hlIFwKICAgICAgICAgZmxhc2tfZ3JhdmF0YXIgXAog ICAgICAgICBmbGFza19taWdyYXRlIFwKICAgICAgICAgc2ltcGxlanNvbiBcCi0gICAgICAgIGNy eXB0b2dyYXBoeQorICAgICAgICBjcnlwdG9ncmFwaHkgXAorICAgICAgICBuZXRhZGRyCiAKICMg Q29weSB0aGUgZG9jcyBmcm9tIHRoZSBsb2NhbCB0cmVlLiBFeHBsaWNpdGx5IHJlbW92ZSBhbnkg ZXhpc3RpbmcgYnVpbGRzIHRoYXQKICMgbWF5IGJlIHByZXNlbnQKQEAgLTE3Nyw2ICsxNzgsNyBA QCBSVU4gbG4gLXNmIC91c3IvbGliL2xpYnBxLnNvLjUuMTIgL3Vzci9saWIvbGlicHEuc28uNQog CiAjIENvcHkgdGhlIHJ1bm5lciBzY3JpcHQKIENPUFkgcGtnL2RvY2tlci9ydW5fcGdhZG1pbi5w eSAvcGdhZG1pbjQKK0NPUFkgcGtnL2RvY2tlci9ndW5pY29ybl9jb25maWcucHkgL3BnYWRtaW40 CiBDT1BZIHBrZy9kb2NrZXIvZW50cnlwb2ludC5zaCAvZW50cnlwb2ludC5zaAogCiAjIFByZWNv bXBpbGUgYW5kIG9wdGltaXplIHB5dGhvbiBjb2RlIHRvIHNhdmUgdGltZSBhbmQgc3BhY2Ugb24g c3RhcnR1cApkaWZmIC0tZ2l0IGEvcGtnL2RvY2tlci9lbnRyeXBvaW50LnNoIGIvcGtnL2RvY2tl ci9lbnRyeXBvaW50LnNoCmluZGV4IDVhNDgyYzcuLjkzZDgwOWYgMTAwNzU1Ci0tLSBhL3BrZy9k b2NrZXIvZW50cnlwb2ludC5zaAorKysgYi9wa2cvZG9ja2VyL2VudHJ5cG9pbnQuc2gKQEAgLTU4 LDcgKzU4LDcgQEAgVElNRU9VVD0kKGNkIC9wZ2FkbWluNCAmJiBweXRob24gLWMgJ2ltcG9ydCBj b25maWc7IHByaW50KGNvbmZpZy5TRVNTSU9OX0VYUElSQVQKICMgVXNpbmcgLS10aHJlYWRzIHRv IGhhdmUgbXVsdGktdGhyZWFkZWQgc2luZ2xlLXByb2Nlc3Mgd29ya2VyCiAKIGlmIFsgISAteiAk e1BHQURNSU5fRU5BQkxFX1RMU30gXTsgdGhlbgotICAgIGV4ZWMgZ3VuaWNvcm4gLS10aW1lb3V0 ICR7VElNRU9VVH0gLS1iaW5kICR7UEdBRE1JTl9MSVNURU5fQUREUkVTUzotWzo6XX06JHtQR0FE TUlOX0xJU1RFTl9QT1JUOi00NDN9IC13IDEgLS10aHJlYWRzICR7R1VOSUNPUk5fVEhSRUFEUzot MjV9IC0tYWNjZXNzLWxvZ2ZpbGUgJHtHVU5JQ09STl9BQ0NFU1NfTE9HRklMRTotLX0gLS1rZXlm aWxlIC9jZXJ0cy9zZXJ2ZXIua2V5IC0tY2VydGZpbGUgL2NlcnRzL3NlcnZlci5jZXJ0IHJ1bl9w Z2FkbWluOmFwcAorICAgIGV4ZWMgZ3VuaWNvcm4gLS10aW1lb3V0ICR7VElNRU9VVH0gLS1iaW5k ICR7UEdBRE1JTl9MSVNURU5fQUREUkVTUzotWzo6XX06JHtQR0FETUlOX0xJU1RFTl9QT1JUOi00 NDN9IC13IDEgLS10aHJlYWRzICR7R1VOSUNPUk5fVEhSRUFEUzotMjV9IC0tYWNjZXNzLWxvZ2Zp bGUgJHtHVU5JQ09STl9BQ0NFU1NfTE9HRklMRTotLX0gLS1rZXlmaWxlIC9jZXJ0cy9zZXJ2ZXIu a2V5IC0tY2VydGZpbGUgL2NlcnRzL3NlcnZlci5jZXJ0IC1jIGd1bmljb3JuX2NvbmZpZy5weSBy dW5fcGdhZG1pbjphcHAKIGVsc2UKLSAgICBleGVjIGd1bmljb3JuIC0tdGltZW91dCAke1RJTUVP VVR9IC0tYmluZCAke1BHQURNSU5fTElTVEVOX0FERFJFU1M6LVs6Ol19OiR7UEdBRE1JTl9MSVNU RU5fUE9SVDotODB9IC13IDEgLS10aHJlYWRzICR7R1VOSUNPUk5fVEhSRUFEUzotMjV9IC0tYWNj ZXNzLWxvZ2ZpbGUgJHtHVU5JQ09STl9BQ0NFU1NfTE9HRklMRTotLX0gcnVuX3BnYWRtaW46YXBw CisgICAgZXhlYyBndW5pY29ybiAtLXRpbWVvdXQgJHtUSU1FT1VUfSAtLWJpbmQgJHtQR0FETUlO X0xJU1RFTl9BRERSRVNTOi1bOjpdfToke1BHQURNSU5fTElTVEVOX1BPUlQ6LTgwfSAtdyAxIC0t dGhyZWFkcyAke0dVTklDT1JOX1RIUkVBRFM6LTI1fSAtLWFjY2Vzcy1sb2dmaWxlICR7R1VOSUNP Uk5fQUNDRVNTX0xPR0ZJTEU6LS19IC1jIGd1bmljb3JuX2NvbmZpZy5weSBydW5fcGdhZG1pbjph cHAKIGZpCmRpZmYgLS1naXQgYS9wa2cvZG9ja2VyL2d1bmljb3JuX2NvbmZpZy5weSBiL3BrZy9k b2NrZXIvZ3VuaWNvcm5fY29uZmlnLnB5Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAw MDAuLjUxM2M4ODkKLS0tIC9kZXYvbnVsbAorKysgYi9wa2cvZG9ja2VyL2d1bmljb3JuX2NvbmZp Zy5weQpAQCAtMCwwICsxLDIgQEAKK2ltcG9ydCBndW5pY29ybgorZ3VuaWNvcm4uU0VSVkVSX1NP RlRXQVJFID0gJ1B5dGhvbicKZGlmZiAtLWdpdCBhL3JlcXVpcmVtZW50cy50eHQgYi9yZXF1aXJl bWVudHMudHh0CmluZGV4IGE1ODE1YTMuLmRiYjAwODMgMTAwNjQ0Ci0tLSBhL3JlcXVpcmVtZW50 cy50eHQKKysrIGIvcmVxdWlyZW1lbnRzLnR4dApAQCAtNDEsNCArNDEsNSBAQCBGbGFzay1TZWN1 cml0eS1Ub28+PTMuMC4wCiBiY3J5cHQ8PTMuMS43CiBjcnlwdG9ncmFwaHk8PTMuMAogc3NodHVu bmVsPj0wLjEuNQorbmV0YWRkcj09MC44LjAKIGxkYXAzPj0yLjUuMQpkaWZmIC0tZ2l0IGEvd2Vi L2NvbmZpZy5weSBiL3dlYi9jb25maWcucHkKaW5kZXggNzAyZTczZi4uNWQ4MGEyOCAxMDA2NDQK LS0tIGEvd2ViL2NvbmZpZy5weQorKysgYi93ZWIvY29uZmlnLnB5CkBAIC0xNDMsMTIgKzE0Myw1 MyBAQCBERUZBVUxUX1NFUlZFUiA9ICcxMjcuMC4wLjEnCiAjIGVudmlyb25tZW50IGJ5IHRoZSBy dW50aW1lCiBERUZBVUxUX1NFUlZFUl9QT1JUID0gNTA1MAogCisjIFRoaXMgcGFyYW0gaXMgdXNl ZCB0byB2YWxpZGF0ZSBBTExPV0VEX0hPU1RTIGZvciB0aGUgYXBwbGljYXRpb24KKyMgVGhpcyB3 aWxsIGJlIHVzZWQgdG8gYXZvaWQgSG9zdCBIZWFkZXIgSW5qZWN0aW9uIGF0dGFjaworIyBGb3Ig aG93IHRvIHNldCBBTExPV0VEX0hPU1RTIHNlZSBuZXRhZGRyIGxpYnJhcnkKKyMgRm9yIG1vcmUg ZGV0YWlscyBodHRwczovL25ldGFkZHIucmVhZHRoZWRvY3MuaW8vZW4vbGF0ZXN0L3R1dG9yaWFs XzAzLmh0bWwKKyMgZS5nLiBBTExPV0VEX0hPU1RTID0gWycxOTIuMC4yLjAvMjgnLCAnOjoxOTIu MC4yLjAvMTI0J10KKyMgQUxMT1dFRF9IT1NUUyA9IFsnMjI1LjAuMC4wLzgnLCAnMjI2LjAuMC4w LzcnLCAnMjI4LjAuMC4wLzYnXQorIyBBTExPV0VEX0hPU1RTID0gWycxMjcuMC4wLjEnLCAnMTky LjE2OC4wLjEnXQorIyBpZiBBTExPV0VEX0hPU1RTPSBbXSB0aGVuIGl0IHdpbGwgYWNjZXB0IGFs bCBpcHMgKGFuZCBhcHBsaWNhdGlvbiB3aWxsIGJlCisjIHZ1bG5lcmFibGUgdG8gSG9zdCBIZWFk ZXIgSW5qZWN0aW9uIGF0dGFjaykKK0FMTE9XRURfSE9TVFMgPSBbXQorCisjIFRoaXMgcGFyYW0g aXMgdXNlZCB0byBvdmVycmlkZSB0aGUgZGVmYXVsdCB3ZWIgc2VydmVyIGluZm9ybWF0aW9uIGFi b3V0CisjIHRoZSB3ZWIgdGVjaG5vbG9neSBhbmQgdGhlIGZyYW1ld29ya3MgYmVpbmcgdXNlZCBp biB0aGUgYXBwbGljYXRpb24KKyMgQW4gYXR0YWNrZXIgY291bGQgdXNlIHRoaXMgaW5mb3JtYXRp b24gdG8gZmluZ2VycHJpbnQgdW5kZXJseWluZyBvcGVyYXRpbmcKKyMgc3lzdGVtIGFuZCByZXNl YXJjaCBrbm93biBleHBsb2l0cyBmb3IgdGhlIHNwZWNpZmljIHZlcnNpb24gb2YKKyMgc29mdHdh cmUgaW4gdXNlCitXRUJfU0VSVkVSID0gJ1B5dGhvbicKKwogIyBFbmFibGUgWC1GcmFtZS1PcHRp b24gcHJvdGVjdGlvbi4KICMgU2V0IHRvIG9uZSBvZiAiU0FNRU9SSUdJTiIsICJBTExPVy1GUk9N IG9yaWdpbiIgb3IgIiIgdG8gZGlzYWJsZS4KICMgTm90ZSB0aGF0ICJERU5ZIiBpcyBOT1Qgc3Vw cG9ydGVkIChhbmQgd2lsbCBiZSBzaWxlbnRseSBpZ25vcmVkKS4KICMgU2VlIGh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9yZmM3MDM0IGZvciBtb3JlIGluZm8uCiBYX0ZSQU1FX09QVElPTlMg PSAiU0FNRU9SSUdJTiIKIAorIyBUaGUgQ29udGVudC1TZWN1cml0eS1Qb2xpY3kgaGVhZGVyIGFs bG93cyB5b3UgdG8gcmVzdHJpY3QgaG93IHJlc291cmNlcworIyBzdWNoIGFzIEphdmFTY3JpcHQs IENTUywgb3IgcHJldHR5IG11Y2ggYW55dGhpbmcgdGhhdCB0aGUgYnJvd3NlciBsb2Fkcy4KKyMg c2VlIGh0dHBzOi8vY29udGVudC1zZWN1cml0eS1wb2xpY3kuY29tLyNzb3VyY2VfbGlzdCBmb3Ig bW9yZSBpbmZvCisjIGUuZy4gImRlZmF1bHQtc3JjIGh0dHBzOiBkYXRhOiAndW5zYWZlLWlubGlu ZScgJ3Vuc2FmZS1ldmFsJzsiCitDT05URU5UX1NFQ1VSSVRZX1BPTElDWSA9ICJkZWZhdWx0LXNy YyBodHRwOiBkYXRhOiBibG9iOiAndW5zYWZlLWlubGluZScgIiBcCisgICAgICAgICAgICAgICAg ICAgICAgICAgICIndW5zYWZlLWV2YWwnOyIKKworIyBUaGUgU3RyaWN0LVRyYW5zcG9ydC1TZWN1 cml0eSBoZWFkZXIgdGVsbHMgdGhlIGJyb3dzZXIgdG8gY29udmVydCBhbGwgSFRUUAorIyByZXF1 ZXN0cyB0byBIVFRQUywgcHJldmVudGluZyBtYW4taW4tdGhlLW1pZGRsZSAoTUlUTSkgYXR0YWNr cy4KKyMgZS5nLiAnbWF4LWFnZT0zMTUzNjAwMDsgaW5jbHVkZVN1YkRvbWFpbnMnCitTVFJJQ1Rf VFJBTlNQT1JUX1NFQ1VSSVRZID0gIm1heC1hZ2U9MzE1MzYwMDA7IGluY2x1ZGVTdWJEb21haW5z IgorCisjIFRoZSBYLUNvbnRlbnQtVHlwZS1PcHRpb25zIGhlYWRlciBmb3JjZXMgdGhlIGJyb3dz ZXIgdG8gaG9ub3IgdGhlIHJlc3BvbnNlCisjIGNvbnRlbnQgdHlwZSBpbnN0ZWFkIG9mIHRyeWlu ZyB0byBkZXRlY3QgaXQsIHdoaWNoIGNhbiBiZSBhYnVzZWQgdG8KKyMgZ2VuZXJhdGUgYSBjcm9z cy1zaXRlIHNjcmlwdGluZyAoWFNTKSBhdHRhY2suCisjIGUuZy4gbm9zbmlmZgorWF9DT05URU5U X1RZUEVfT1BUSU9OUyA9ICJub3NuaWZmIgorCisjIFRoZSBicm93c2VyIHdpbGwgdHJ5IHRvIHBy ZXZlbnQgcmVmbGVjdGVkIFhTUyBhdHRhY2tzIGJ5IG5vdCBsb2FkaW5nIHRoZQorIyBwYWdlIGlm IHRoZSByZXF1ZXN0IGNvbnRhaW5zIHNvbWV0aGluZyB0aGF0IGxvb2tzIGxpa2UgSmF2YVNjcmlw dCBhbmQgdGhlCisjIHJlc3BvbnNlIGNvbnRhaW5zIHRoZSBzYW1lIGRhdGEuIGUuZy4gJzE7IG1v ZGU9YmxvY2snCitYX1hTU19QUk9URUNUSU9OID0gIjE7IG1vZGU9YmxvY2siCisKICMgSGFzaGlu ZyBhbGdvcml0aG0gdXNlZCBmb3IgcGFzc3dvcmQgc3RvcmFnZQogU0VDVVJJVFlfUEFTU1dPUkRf SEFTSCA9ICdwYmtkZjJfc2hhNTEyJwogCkBAIC00MjEsMTIgKzQ2MiwxNCBAQCBPTl9ERU1BTkRf UkVDT1JEX0NPVU5UID0gMTAwMAogU0hPV19HUkFWQVRBUl9JTUFHRSA9IFRydWUKIAogIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMKLSMgU2V0IGNvb2tpZSBwYXRoCisjIFNldCBjb29raWUgcGF0aCBhbmQgb3B0 aW9ucwogIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIENPT0tJRV9ERUZBVUxUX1BBVEggPSAnLycKIENPT0tJ RV9ERUZBVUxUX0RPTUFJTiA9IE5vbmUKIFNFU1NJT05fQ09PS0lFX0RPTUFJTiA9IE5vbmUKIFNF U1NJT05fQ09PS0lFX1NBTUVTSVRFID0gJ0xheCcKK1NFU1NJT05fQ09PS0lFX1NFQ1VSRSA9IEZh bHNlCitTRVNTSU9OX0NPT0tJRV9IVFRQT05MWSA9IFRydWUKIAogIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwog IyBTa2lwIHN0b3Jpbmcgc2Vzc2lvbiBpbiBmaWxlcyBhbmQgY2FjaGUgZm9yIHNwZWNpZmljIHBh dGhzCmRpZmYgLS1naXQgYS93ZWIvcGdhZG1pbi9fX2luaXRfXy5weSBiL3dlYi9wZ2FkbWluL19f aW5pdF9fLnB5CmluZGV4IDI3NWYzNjUuLjU5Y2FiNjIgMTAwNjQ0Ci0tLSBhL3dlYi9wZ2FkbWlu L19faW5pdF9fLnB5CisrKyBiL3dlYi9wZ2FkbWluL19faW5pdF9fLnB5CkBAIC0xMiw2ICsxMiw3 IEBAIHN1Y2ggYXMgc2V0dXAgb2YgbG9nZ2luZywgZHluYW1pYyBsb2FkaW5nIG9mIG1vZHVsZXMg ZXRjLiIiIgogaW1wb3J0IGxvZ2dpbmcKIGltcG9ydCBvcwogaW1wb3J0IHN5cworaW1wb3J0IHJl CiBmcm9tIHR5cGVzIGltcG9ydCBNZXRob2RUeXBlCiBmcm9tIGNvbGxlY3Rpb25zIGltcG9ydCBk ZWZhdWx0ZGljdAogZnJvbSBpbXBvcnRsaWIgaW1wb3J0IGltcG9ydF9tb2R1bGUKQEAgLTE5LDEx ICsyMCwxMyBAQCBmcm9tIGltcG9ydGxpYiBpbXBvcnQgaW1wb3J0X21vZHVsZQogZnJvbSBmbGFz ayBpbXBvcnQgRmxhc2ssIGFib3J0LCByZXF1ZXN0LCBjdXJyZW50X2FwcCwgc2Vzc2lvbiwgdXJs X2ZvcgogZnJvbSB3ZXJremV1Zy5leGNlcHRpb25zIGltcG9ydCBIVFRQRXhjZXB0aW9uCiBmcm9t IGZsYXNrX2JhYmVsZXggaW1wb3J0IEJhYmVsLCBnZXR0ZXh0Citmcm9tIGZsYXNrX2JhYmVsZXgg aW1wb3J0IGdldHRleHQgYXMgXwogZnJvbSBmbGFza19sb2dpbiBpbXBvcnQgdXNlcl9sb2dnZWRf aW4sIHVzZXJfbG9nZ2VkX291dAogZnJvbSBmbGFza19tYWlsIGltcG9ydCBNYWlsCiBmcm9tIGZs YXNrX3BhcmFub2lkIGltcG9ydCBQYXJhbm9pZAogZnJvbSBmbGFza19zZWN1cml0eSBpbXBvcnQg U2VjdXJpdHksIFNRTEFsY2hlbXlVc2VyRGF0YXN0b3JlLCBjdXJyZW50X3VzZXIKIGZyb20gZmxh c2tfc2VjdXJpdHkudXRpbHMgaW1wb3J0IGxvZ2luX3VzZXIsIGxvZ291dF91c2VyCitmcm9tIG5l dGFkZHIgaW1wb3J0IElQU2V0CiBmcm9tIHdlcmt6ZXVnLmRhdGFzdHJ1Y3R1cmVzIGltcG9ydCBJ bW11dGFibGVEaWN0CiBmcm9tIHdlcmt6ZXVnLmxvY2FsIGltcG9ydCBMb2NhbFByb3h5CiBmcm9t IHdlcmt6ZXVnLnV0aWxzIGltcG9ydCBmaW5kX21vZHVsZXMKQEAgLTM2LDkgKzM5LDEwIEBAIGZy b20gcGdhZG1pbi51dGlscy5zZXNzaW9uIGltcG9ydCBjcmVhdGVfc2Vzc2lvbl9pbnRlcmZhY2Us IHBnYV91bmF1dGhvcmlzZWQKIGZyb20gcGdhZG1pbi51dGlscy52ZXJzaW9uZWRfdGVtcGxhdGVf bG9hZGVyIGltcG9ydCBWZXJzaW9uZWRUZW1wbGF0ZUxvYWRlcgogZnJvbSBkYXRldGltZSBpbXBv cnQgdGltZWRlbHRhCiBmcm9tIHBnYWRtaW4uc2V0dXAgaW1wb3J0IGdldF92ZXJzaW9uLCBzZXRf dmVyc2lvbgotZnJvbSBwZ2FkbWluLnV0aWxzLmFqYXggaW1wb3J0IGludGVybmFsX3NlcnZlcl9l cnJvcgorZnJvbSBwZ2FkbWluLnV0aWxzLmFqYXggaW1wb3J0IGludGVybmFsX3NlcnZlcl9lcnJv ciwgbWFrZV9qc29uX3Jlc3BvbnNlCiBmcm9tIHBnYWRtaW4udXRpbHMuY3NyZiBpbXBvcnQgcGdD U1JGUHJvdGVjdAogZnJvbSBwZ2FkbWluIGltcG9ydCBhdXRoZW50aWNhdGUKK2Zyb20gcGdhZG1p bi51dGlscy5zZWN1cml0eV9oZWFkZXJzIGltcG9ydCBTZWN1cml0eUhlYWRlcnMKIAogd2lucmVn ID0gTm9uZQogaWYgb3MubmFtZSA9PSAnbnQnOgpAQCAtNjU4LDYgKzY2MiwzNiBAQCBkZWYgY3Jl YXRlX2FwcChhcHBfbmFtZT1Ob25lKToKICAgICAgICAgICAgICAgICByZXF1ZXN0LmVuZHBvaW50 IG5vdCBpbiAoJ3NlY3VyaXR5LmxvZ2luJywgJ3NlY3VyaXR5LmxvZ291dCcpOgogICAgICAgICAg ICAgbG9nb3V0X3VzZXIoKQogCisgICAgQGFwcC5iZWZvcmVfcmVxdWVzdAorICAgIGRlZiBsaW1p dF9ob3N0X2FkZHIoKToKKyAgICAgICAgIiIiCisgICAgICAgIFRoaXMgZnVuY3Rpb24gdmFsaWRh dGUgdGhlIGhvc3RzIGZyb20gQUxMT1dFRF9IT1NUUyBiZWZvcmUgYWxsb3dpbmcKKyAgICAgICAg SFRUUCByZXF1ZXN0IHRvIGF2b2lkIEhvc3QgSGVhZGVyIEluamVjdGlvbiBhdHRhY2sKKyAgICAg ICAgOnJldHVybjogTm9uZS9KU09OIHJlc3BvbnNlIHdpdGggNDAzIEhUVFAgc3RhdHVzIGNvZGUK KyAgICAgICAgIiIiCisgICAgICAgIGNsaWVudF9ob3N0ID0gc3RyKHJlcXVlc3QuaG9zdCkuc3Bs aXQoJzonKVswXQorICAgICAgICB2YWxpZCA9IFRydWUKKyAgICAgICAgYWxsb3dlZF9ob3N0cyA9 IGNvbmZpZy5BTExPV0VEX0hPU1RTCisKKyAgICAgICAgaWYgbGVuKGFsbG93ZWRfaG9zdHMpICE9 IDA6CisgICAgICAgICAgICByZWdleCA9IHJlLmNvbXBpbGUoCisgICAgICAgICAgICAgICAgcidc ZHsxLDN9XC5cZHsxLDN9XC5cZHsxLDN9XC5cZHsxLDN9KD86L1xkezEsMn18KScpCisgICAgICAg ICAgICAjIENyZWF0ZSBzZXBhcmF0ZSBsaXN0IGZvciBpcCBhZGRyZXNzZXMgYW5kIGhvc3QgbmFt ZXMKKyAgICAgICAgICAgIGlwX3NldCA9IGxpc3QoZmlsdGVyKGxhbWJkYSBpcDogcmVnZXgubWF0 Y2goaXApLCBhbGxvd2VkX2hvc3RzKSkKKyAgICAgICAgICAgIGhvc3Rfc2V0ID0gbGlzdChmaWx0 ZXIobGFtYmRhIGlwOiBub3QgcmVnZXgubWF0Y2goaXApLAorICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBhbGxvd2VkX2hvc3RzKSkKKyAgICAgICAgICAgIGlzX2lwID0gcmVnZXgu bWF0Y2goY2xpZW50X2hvc3QpCisgICAgICAgICAgICBpZiBpc19pcDoKKyAgICAgICAgICAgICAg ICB2YWxpZCA9IElQU2V0KGlwX3NldCkuX19jb250YWluc19fKGNsaWVudF9ob3N0KQorICAgICAg ICAgICAgZWxzZToKKyAgICAgICAgICAgICAgICB2YWxpZCA9IGhvc3Rfc2V0Ll9fY29udGFpbnNf XyhjbGllbnRfaG9zdCkKKworICAgICAgICBpZiBub3QgdmFsaWQ6CisgICAgICAgICAgICByZXR1 cm4gbWFrZV9qc29uX3Jlc3BvbnNlKAorICAgICAgICAgICAgICAgIHN0YXR1cz00MDMsIHN1Y2Nl c3M9MCwKKyAgICAgICAgICAgICAgICBlcnJvcm1zZz1fKCI0MDMgRk9SQklEREVOIikKKyAgICAg ICAgICAgICkKKwogICAgIEBhcHAuYWZ0ZXJfcmVxdWVzdAogICAgIGRlZiBhZnRlcl9yZXF1ZXN0 KHJlc3BvbnNlKToKICAgICAgICAgaWYgJ2tleScgaW4gcmVxdWVzdC5hcmdzOgpAQCAtNjY3LDEz ICs3MDEsMTIgQEAgZGVmIGNyZWF0ZV9hcHAoYXBwX25hbWU9Tm9uZSk6CiAgICAgICAgICAgICAg ICAgZG9tYWluWydkb21haW4nXSA9IGNvbmZpZy5DT09LSUVfREVGQVVMVF9ET01BSU4KICAgICAg ICAgICAgIHJlc3BvbnNlLnNldF9jb29raWUoJ1BHQURNSU5fSU5UX0tFWScsIHZhbHVlPXJlcXVl c3QuYXJnc1sna2V5J10sCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBhdGg9Y29u ZmlnLkNPT0tJRV9ERUZBVUxUX1BBVEgsCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHNlY3VyZT1jb25maWcuU0VTU0lPTl9DT09LSUVfU0VDVVJFLAorICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBodHRwb25seT1jb25maWcuU0VTU0lPTl9DT09LSUVfSFRUUE9OTFksCisg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNhbWVzaXRlPWNvbmZpZy5TRVNTSU9OX0NP T0tJRV9TQU1FU0lURSwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKipkb21haW4p CiAKLSAgICAgICAgIyBYLUZyYW1lLU9wdGlvbnMgZm9yIHNlY3VyaXR5Ci0gICAgICAgIGlmIGNv bmZpZy5YX0ZSQU1FX09QVElPTlMgIT0gIiIgYW5kIFwKLSAgICAgICAgICAgICAgICBjb25maWcu WF9GUkFNRV9PUFRJT05TLmxvd2VyKCkgIT0gImRlbnkiOgotICAgICAgICAgICAgcmVzcG9uc2Uu aGVhZGVyc1siWC1GcmFtZS1PcHRpb25zIl0gPSBjb25maWcuWF9GUkFNRV9PUFRJT05TCi0KKyAg ICAgICAgU2VjdXJpdHlIZWFkZXJzLnNldF9yZXNwb25zZV9oZWFkZXJzKHJlc3BvbnNlKQogICAg ICAgICByZXR1cm4gcmVzcG9uc2UKIAogICAgICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCmRpZmYgLS1naXQg YS93ZWIvcGdhZG1pbi9icm93c2VyL19faW5pdF9fLnB5IGIvd2ViL3BnYWRtaW4vYnJvd3Nlci9f X2luaXRfXy5weQppbmRleCA1Mzc1ZTk0Li42ZWQxMzhiIDEwMDY0NAotLS0gYS93ZWIvcGdhZG1p bi9icm93c2VyL19faW5pdF9fLnB5CisrKyBiL3dlYi9wZ2FkbWluL2Jyb3dzZXIvX19pbml0X18u cHkKQEAgLTY5Nyw2ICs2OTcsOSBAQCBkZWYgaW5kZXgoKToKIAogICAgIHJlc3BvbnNlLnNldF9j b29raWUoIlBHQURNSU5fTEFOR1VBR0UiLCB2YWx1ZT1sYW5ndWFnZSwKICAgICAgICAgICAgICAg ICAgICAgICAgIHBhdGg9Y29uZmlnLkNPT0tJRV9ERUZBVUxUX1BBVEgsCisgICAgICAgICAgICAg ICAgICAgICAgICBzZWN1cmU9Y29uZmlnLlNFU1NJT05fQ09PS0lFX1NFQ1VSRSwKKyAgICAgICAg ICAgICAgICAgICAgICAgIGh0dHBvbmx5PWNvbmZpZy5TRVNTSU9OX0NPT0tJRV9IVFRQT05MWSwK KyAgICAgICAgICAgICAgICAgICAgICAgIHNhbWVzaXRlPWNvbmZpZy5TRVNTSU9OX0NPT0tJRV9T QU1FU0lURSwKICAgICAgICAgICAgICAgICAgICAgICAgICoqZG9tYWluKQogCiAgICAgcmV0dXJu IHJlc3BvbnNlCmRpZmYgLS1naXQgYS93ZWIvcGdhZG1pbi9wcmVmZXJlbmNlcy9fX2luaXRfXy5w eSBiL3dlYi9wZ2FkbWluL3ByZWZlcmVuY2VzL19faW5pdF9fLnB5CmluZGV4IGRiMTFkMWQuLmQw NWMxYzggMTAwNjQ0Ci0tLSBhL3dlYi9wZ2FkbWluL3ByZWZlcmVuY2VzL19faW5pdF9fLnB5Cisr KyBiL3dlYi9wZ2FkbWluL3ByZWZlcmVuY2VzL19faW5pdF9fLnB5CkBAIC0yMzIsNiArMjMyLDkg QEAgZGVmIHNhdmUocGlkKToKICAgICBzZXRhdHRyKHNlc3Npb24sICdQR0FETUlOX0xBTkdVQUdF JywgbGFuZ3VhZ2UpCiAgICAgcmVzcG9uc2Uuc2V0X2Nvb2tpZSgiUEdBRE1JTl9MQU5HVUFHRSIs IHZhbHVlPWxhbmd1YWdlLAogICAgICAgICAgICAgICAgICAgICAgICAgcGF0aD1jb25maWcuQ09P S0lFX0RFRkFVTFRfUEFUSCwKKyAgICAgICAgICAgICAgICAgICAgICAgIHNlY3VyZT1jb25maWcu U0VTU0lPTl9DT09LSUVfU0VDVVJFLAorICAgICAgICAgICAgICAgICAgICAgICAgaHR0cG9ubHk9 Y29uZmlnLlNFU1NJT05fQ09PS0lFX0hUVFBPTkxZLAorICAgICAgICAgICAgICAgICAgICAgICAg c2FtZXNpdGU9Y29uZmlnLlNFU1NJT05fQ09PS0lFX1NBTUVTSVRFLAogICAgICAgICAgICAgICAg ICAgICAgICAgKipkb21haW4pCiAKICAgICByZXR1cm4gcmVzcG9uc2UKZGlmZiAtLWdpdCBhL3dl Yi9wZ2FkbWluL3V0aWxzL3NlY3VyaXR5X2hlYWRlcnMucHkgYi93ZWIvcGdhZG1pbi91dGlscy9z ZWN1cml0eV9oZWFkZXJzLnB5Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLmMz Y2YzMWMKLS0tIC9kZXYvbnVsbAorKysgYi93ZWIvcGdhZG1pbi91dGlscy9zZWN1cml0eV9oZWFk ZXJzLnB5CkBAIC0wLDAgKzEsMzYgQEAKKyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCisjCisjIHBnQWRtaW4g NCAtIFBvc3RncmVTUUwgVG9vbHMKKyMKKyMgQ29weXJpZ2h0IChDKSAyMDEzIC0gMjAyMCwgVGhl IHBnQWRtaW4gRGV2ZWxvcG1lbnQgVGVhbQorIyBUaGlzIHNvZnR3YXJlIGlzIHJlbGVhc2VkIHVu ZGVyIHRoZSBQb3N0Z3JlU1FMIExpY2VuY2UKKyMKKyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKKworaW1wb3J0 IGNvbmZpZworCisKK2NsYXNzIFNlY3VyaXR5SGVhZGVyczoKKworICAgIEBzdGF0aWNtZXRob2QK KyAgICBkZWYgc2V0X3Jlc3BvbnNlX2hlYWRlcnMocmVzcG9uc2UpOgorICAgICAgICAiIiJzZXQg cmVzcG9uc2Ugc2VjdXJpdHkgaGVhZGVycyIiIgorCisgICAgICAgIHBhcmFtc19kaWN0ID0gewor ICAgICAgICAgICAgJ0NPTlRFTlRfU0VDVVJJVFlfUE9MSUNZJzogJ0NvbnRlbnQtU2VjdXJpdHkt UG9saWN5JywKKyAgICAgICAgICAgICdTVFJJQ1RfVFJBTlNQT1JUX1NFQ1VSSVRZJzogJ1N0cmlj dC1UcmFuc3BvcnQtU2VjdXJpdHknLAorICAgICAgICAgICAgJ1hfQ09OVEVOVF9UWVBFX09QVElP TlMnOiAnWC1Db250ZW50LVR5cGUtT3B0aW9ucycsCisgICAgICAgICAgICAnWF9YU1NfUFJPVEVD VElPTic6ICdYLVhTUy1Qcm90ZWN0aW9uJywKKyAgICAgICAgICAgICdXRUJfU0VSVkVSJzogJ1Nl cnZlcicsCisgICAgICAgIH0KKworICAgICAgICAjIFgtRnJhbWUtT3B0aW9ucyBmb3Igc2VjdXJp dHkKKyAgICAgICAgaWYgY29uZmlnLlhfRlJBTUVfT1BUSU9OUyAhPSAiIiBhbmQgXAorICAgICAg ICAgICAgICAgIGNvbmZpZy5YX0ZSQU1FX09QVElPTlMubG93ZXIoKSAhPSAiZGVueSI6CisgICAg ICAgICAgICByZXNwb25zZS5oZWFkZXJzWyJYLUZyYW1lLU9wdGlvbnMiXSA9IGNvbmZpZy5YX0ZS QU1FX09QVElPTlMKKworICAgICAgICAjIGFkZCBvdGhlciBzZWN1cml0eSBvcHRpb25zCisgICAg ICAgIGZvciBrZXkgaW4gcGFyYW1zX2RpY3Q6CisgICAgICAgICAgICBpZiBrZXkgaW4gY29uZmln Ll9fZGljdF9fIGFuZCBjb25maWcuX19kaWN0X19ba2V5XSAhPSAiIiBcCisgICAgICAgICAgICAg ICAgICAgIGFuZCBjb25maWcuX19kaWN0X19ba2V5XSBpcyBub3QgTm9uZToKKyAgICAgICAgICAg ICAgICByZXNwb25zZS5oZWFkZXJzW3BhcmFtc19kaWN0W2tleV1dID0gY29uZmlnLl9fZGljdF9f W2tleV0KZGlmZiAtLWdpdCBhL3dlYi9wZ2FkbWluL3V0aWxzL3Nlc3Npb24ucHkgYi93ZWIvcGdh ZG1pbi91dGlscy9zZXNzaW9uLnB5CmluZGV4IGI4YWYzZDQuLjYyZTAzYmEgMTAwNjQ0Ci0tLSBh L3dlYi9wZ2FkbWluL3V0aWxzL3Nlc3Npb24ucHkKKysrIGIvd2ViL3BnYWRtaW4vdXRpbHMvc2Vz c2lvbi5weQpAQCAtMzExLDcgKzMxMSwxMSBAQCBjbGFzcyBNYW5hZ2VkU2Vzc2lvbkludGVyZmFj ZShTZXNzaW9uSW50ZXJmYWNlKToKICAgICAgICAgcmVzcG9uc2Uuc2V0X2Nvb2tpZSgKICAgICAg ICAgICAgIGFwcC5zZXNzaW9uX2Nvb2tpZV9uYW1lLAogICAgICAgICAgICAgJyVzISVzJyAlIChz ZXNzaW9uLnNpZCwgc2Vzc2lvbi5obWFjX2RpZ2VzdCksCi0gICAgICAgICAgICBleHBpcmVzPWNv b2tpZV9leHAsIGh0dHBvbmx5PVRydWUsIGRvbWFpbj1kb21haW4KKyAgICAgICAgICAgIGV4cGly ZXM9Y29va2llX2V4cCwKKyAgICAgICAgICAgIHNlY3VyZT1jb25maWcuU0VTU0lPTl9DT09LSUVf U0VDVVJFLAorICAgICAgICAgICAgaHR0cG9ubHk9Y29uZmlnLlNFU1NJT05fQ09PS0lFX0hUVFBP TkxZLAorICAgICAgICAgICAgc2FtZXNpdGU9Y29uZmlnLlNFU1NJT05fQ09PS0lFX1NBTUVTSVRF LAorICAgICAgICAgICAgZG9tYWluPWRvbWFpbgogICAgICAgICApCiAKIAo= --00000000000037bc7305b204dfd9--