319428 2013-05-06 20:06:29 +0000 notifications about errors contain password 2013-05-15 22:01:21 +0000 1 1 10 Unmaintained kio http 4.10.3 Ubuntu Linux RESOLVED FIXED NOR normal --- 1 m.wege kdelibs-bugs-null greg kevin.kofler montel winter http://commits.kde.org/kdelibs/898135a59d91184692ed1bcee8bb4c6d80d6f7b9 0 oldest_to_newest 1366778 0 m.wege 2013-05-06 20:06:29 +0000 I just received a notification from the ressource which read "internal server error" and the url https://username:password@serveradress.com/remote.php.carddav... I believe it is not a good idea to have a password in a notication. Reproducible: Always 1366957 1 winter 2013-05-07 14:02:45 +0000 somewhere a message is using url() rather than prettyUrl(). but so far I haven't had any luck finding where in the code. maybe another set of eyes will have more luck. should be an easy fix once we find the offending text. 1367014 2 montel 2013-05-07 17:10:42 +0000 We need a screenshot or exact error message to find it. 1367090 3 m.wege 2013-05-07 21:19:16 +0000 Is there a way to provoke a connection error? It doesn't work when just disconnecting the internet. The cause must have been on the server side, so I will only see the message again, when I can fake a server error or it happens again. 1367425 4 greg 2013-05-08 20:01:57 +0000 I think this was introduced by 649a97d08771020a4e5151bbc041e82405f5841c, at least that the only commit I can thin of that touched the error messages. If true, there are some chances that the issue comes from KIO. 1367428 5 greg 2013-05-08 20:14:48 +0000 Looks like the source is in kdelibs/kioslave/http/http.cpp:3059, where url() is used instead of prettyUrl() as the error message. Do you think this can go into kdelibs for 4.10.4? 1367439 6 winter 2013-05-08 20:57:40 +0000 yes please. looks like changing that line to use m_request.url.host() might be the correct solution. In fact, once this is fixed I'll send a note to the packages that they might want to hotpatch their 4.10.3 releases. 1367441 7 greg 2013-05-08 21:13:39 +0000 (In reply to comment #6) > looks like changing that line to use m_request.url.host() might be the > correct solution. Having the full URL that triggered this error would help finding the issue, so I'm not certain that just keeping the hostname would be satisfying to most users. As for the usage of this string there's a new line between 'Internal error in server' and the error text, which makes mes doubt that %1 stands for the hostname in the full message. Otherwise, looking around this line the m_request.url.url() is also used in the same way (lines 3075 and 3077). I'll also replace those with prettyUrl(). 1367447 8 greg 2013-05-08 21:38:57 +0000 Git commit 65d736dab592bced4410ccfa4699de89f78c96ca by Grégory Oestreicher. Committed on 08/05/2013 at 23:16. Pushed by goestreicher into branch 'KDE/4.10'. Don't show passwords contained in HTTP URLs in error messages M +3 -3 kioslave/http/http.cpp http://commits.kde.org/kdelibs/65d736dab592bced4410ccfa4699de89f78c96ca 1368809 9 kevin.kofler 2013-05-14 15:51:29 +0000 While working on a fix for the Fedora kdelibs3 compatibility package, I noticed that your fix for 4.10 is NOT complete: There are at least 2 instances where url() (rather than prettyUrl()) is still used in error messages! https://projects.kde.org/projects/kde/kdelibs/repository/entry/kioslave/http/http.cpp?rev=KDE%2F4.10#L1582 This one looks particularly weird: Only if the URL is NOT null, it gets replaced with the default??? I think the ! there is too much. But the main issue is that it uses url() and (later in the function) prints the thing. https://projects.kde.org/projects/kde/kdelibs/repository/entry/kioslave/http/http.cpp?rev=KDE%2F4.10#L3467 And this one shouldn't need any explanation of why it's bad. 1368811 10 79887 kevin.kofler 2013-05-14 16:20:30 +0000 Created attachment 79887 kdelibs-3.5.10-CVE-2013-2074.patch For reference (and for other distros which still ship kdelibs3), here's my tentative kdelibs3 patch. In addition to what you fixed, this patch also fixes the debugging output (fixed in 4.x by an earlier commit), the 2 spots I pointed out above, and 1 additional one I can't find in the 4.10 code (the error(ERR_ACCESS_DENIED, u.url()); line – it apparently got rewritten or removed). 1369091 11 greg 2013-05-15 19:54:43 +0000 (In reply to comment #9) > While working on a fix for the Fedora kdelibs3 compatibility package, I > noticed that your fix for 4.10 is NOT complete: There are at least 2 > instances where url() (rather than prettyUrl()) is still used in error > messages! Wow, thanks a lot for that. > https://projects.kde.org/projects/kde/kdelibs/repository/entry/kioslave/http/ > http.cpp?rev=KDE%2F4.10#L1582 > This one looks particularly weird: Only if the URL is NOT null, it gets > replaced with the default??? I think that url can be null is _url cannot be converted, so it looks legitimate. However you're right, prettyUrl() should indeed be used. > https://projects.kde.org/projects/kde/kdelibs/repository/entry/kioslave/http/ > http.cpp?rev=KDE%2F4.10#L3467 > And this one shouldn't need any explanation of why it's bad. Indeed. Thanks a lot for you help, I'll fix those. Cheers, Grégory 1369092 12 greg 2013-05-15 19:58:18 +0000 Git commit 898135a59d91184692ed1bcee8bb4c6d80d6f7b9 by Grégory Oestreicher. Committed on 15/05/2013 at 21:56. Pushed by goestreicher into branch 'KDE/4.10'. Continue hiding passwords in URLs displayed to the user The fix introduced by 65d736da missed two usages of url() instead of prettyUrl(). Thanks to Kevin Kofler for spotting those. M +2 -2 kioslave/http/http.cpp http://commits.kde.org/kdelibs/898135a59d91184692ed1bcee8bb4c6d80d6f7b9 1369116 13 kevin.kofler 2013-05-15 22:01:21 +0000 > I think that url can be null is _url cannot be converted, so it looks legitimate. 1. There's no conversion there. It's just a copy from a const QString & to a writable QString. 2. The thing there is that it checks for if (!url.isNull()) when I think it wants to actually check for if (url.isNull()) without the '!' (or maybe actually for if (url.isEmpty()), again without negation; checking strings for isNull is not recommended and rarely needed). The code looks to me like the intention was to fill in a default value if no URL was given, whereas as written now, it leaves it empty if it was empty and it overwrites it with the default value if it was not empty. 79887 2013-05-14 16:20:30 +0000 2013-05-14 16:20:30 +0000 kdelibs-3.5.10-CVE-2013-2074.patch kdelibs-3.5.10-CVE-2013-2074.patch text/plain 6187 kevin.kofler ZGlmZiAtdXIga2RlbGlicy0zLjUuMTAva2lvc2xhdmUvaHR0cC9odHRwLmNjIGtkZWxpYnMtMy41 LjEwLUNWRS0yMDEzLTIwNzQva2lvc2xhdmUvaHR0cC9odHRwLmNjCi0tLSBrZGVsaWJzLTMuNS4x MC9raW9zbGF2ZS9odHRwL2h0dHAuY2MJMjAwOC0wMi0xMyAxMDo0MTowNi4wMDAwMDAwMDAgKzAx MDAKKysrIGtkZWxpYnMtMy41LjEwLUNWRS0yMDEzLTIwNzQva2lvc2xhdmUvaHR0cC9odHRwLmNj CTIwMTMtMDUtMTQgMTc6NTQ6NDIuMDAwMDAwMDAwICswMjAwCkBAIC0yODgsNyArMjg4LDcgQEAK ICAgICBtX2JVc2VQcm94eSA9IG1fcHJveHlVUkwuaXNWYWxpZCgpOwogCiAgICAga2REZWJ1Zyg3 MTEzKSA8PCAiKCIgPDwgbV9waWQgPDwgIikgVXNpbmcgcHJveHk6ICIgPDwgbV9iVXNlUHJveHkg PDwKLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiIFVSTDog IiA8PCBtX3Byb3h5VVJMLnVybCgpIDw8CisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIiBVUkw6ICIgPDwgbV9wcm94eVVSTC5wcmV0dHlVUkwoKSA8PAogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiIFJlYWxtOiAiIDw8IG1f c3RyUHJveHlSZWFsbSA8PCBlbmRsOwogICB9CiAKQEAgLTQ1OCw3ICs0NTgsNyBAQAogCiBib29s IEhUVFBQcm90b2NvbDo6Y2hlY2tSZXF1ZXN0VVJMKCBjb25zdCBLVVJMJiB1ICkKIHsKLSAga2RE ZWJ1ZyAoNzExMykgPDwgIigiIDw8IG1fcGlkIDw8ICIpIEhUVFBQcm90b2NvbDo6Y2hlY2tSZXF1 ZXN0VVJMOiAgIiA8PCB1LnVybCgpIDw8IGVuZGw7CisgIGtkRGVidWcgKDcxMTMpIDw8ICIoIiA8 PCBtX3BpZCA8PCAiKSBIVFRQUHJvdG9jb2w6OmNoZWNrUmVxdWVzdFVSTDogICIgPDwgdS5wcmV0 dHlVUkwoKSA8PCBlbmRsOwogCiAgIG1fcmVxdWVzdC51cmwgPSB1OwogCkBAIC02NDAsNyArNjQw LDcgQEAKIAogdm9pZCBIVFRQUHJvdG9jb2w6Omxpc3REaXIoIGNvbnN0IEtVUkwmIHVybCApCiB7 Ci0gIGtkRGVidWcoNzExMykgPDwgIigiIDw8IG1fcGlkIDw8ICIpIEhUVFBQcm90b2NvbDo6bGlz dERpciAiIDw8IHVybC51cmwoKQorICBrZERlYnVnKDcxMTMpIDw8ICIoIiA8PCBtX3BpZCA8PCAi KSBIVFRQUHJvdG9jb2w6Omxpc3REaXIgIiA8PCB1cmwucHJldHR5VVJMKCkKICAgICAgICAgICAg ICAgICA8PCBlbmRsOwogCiAgIGlmICggIWNoZWNrUmVxdWVzdFVSTCggdXJsICkgKQpAQCAtODA3 LDcgKzgwNyw3IEBACiAKIHZvaWQgSFRUUFByb3RvY29sOjpkYXZHZW5lcmljKCBjb25zdCBLVVJM JiB1cmwsIEtJTzo6SFRUUF9NRVRIT0QgbWV0aG9kICkKIHsKLSAga2REZWJ1Zyg3MTEzKSA8PCAi KCIgPDwgbV9waWQgPDwgIikgSFRUUFByb3RvY29sOjpkYXZHZW5lcmljICIgPDwgdXJsLnVybCgp CisgIGtkRGVidWcoNzExMykgPDwgIigiIDw8IG1fcGlkIDw8ICIpIEhUVFBQcm90b2NvbDo6ZGF2 R2VuZXJpYyAiIDw8IHVybC5wcmV0dHlVUkwoKQogICAgICAgICAgICAgICAgIDw8IGVuZGw7CiAK ICAgaWYgKCAhY2hlY2tSZXF1ZXN0VVJMKCB1cmwgKSApCkBAIC0xMjA2LDcgKzEyMDYsNyBAQAog CiB2b2lkIEhUVFBQcm90b2NvbDo6bWtkaXIoIGNvbnN0IEtVUkwmIHVybCwgaW50ICkKIHsKLSAg a2REZWJ1Zyg3MTEzKSA8PCAiKCIgPDwgbV9waWQgPDwgIikgSFRUUFByb3RvY29sOjpta2RpciAi IDw8IHVybC51cmwoKQorICBrZERlYnVnKDcxMTMpIDw8ICIoIiA8PCBtX3BpZCA8PCAiKSBIVFRQ UHJvdG9jb2w6Om1rZGlyICIgPDwgdXJsLnByZXR0eVVSTCgpCiAgICAgICAgICAgICAgICAgPDwg ZW5kbDsKIAogICBpZiAoICFjaGVja1JlcXVlc3RVUkwoIHVybCApICkKQEAgLTEyMjgsNyArMTIy OCw3IEBACiAKIHZvaWQgSFRUUFByb3RvY29sOjpnZXQoIGNvbnN0IEtVUkwmIHVybCApCiB7Ci0g IGtkRGVidWcoNzExMykgPDwgIigiIDw8IG1fcGlkIDw8ICIpIEhUVFBQcm90b2NvbDo6Z2V0ICIg PDwgdXJsLnVybCgpCisgIGtkRGVidWcoNzExMykgPDwgIigiIDw8IG1fcGlkIDw8ICIpIEhUVFBQ cm90b2NvbDo6Z2V0ICIgPDwgdXJsLnByZXR0eVVSTCgpCiAgICAgICAgICAgICAgICAgPDwgZW5k bDsKIAogICBpZiAoICFjaGVja1JlcXVlc3RVUkwoIHVybCApICkKQEAgLTE1NDMsOCArMTU0Mywx MCBAQAogICAgIGNhbGxFcnJvciA9IHRydWU7CiAgIH0KIAorICAvLyBIdWg/IFRoaXMgbG9va3Mg bGlrZSBpbnZlcnRlZCBsb2dpYyB0byBtZSAoaXQgZG9lc24ndCBtYWtlIHNlbnNlIHRvIG1lIGFz CisgIC8vIHdyaXR0ZW4pLCBidXQgSSdtIG9ubHkgZml4aW5nIHRoZSBDVkUgbm93LiAtLSBLZXZp biBLb2ZsZXIKICAgaWYgKCAhdXJsLmlzTnVsbCgpICkKLSAgICB1cmwgPSBtX3JlcXVlc3QudXJs LnVybCgpOworICAgIHVybCA9IG1fcmVxdWVzdC51cmwucHJldHR5VVJMKCk7CiAKICAgUVN0cmlu ZyBhY3Rpb24sIGVycm9yU3RyaW5nOwogICBLSU86OkVycm9yIGtFcnJvcjsKQEAgLTE4NDAsNyAr MTg0Miw3IEBACiAgICAgIGlmICggIWNoZWNrUmVxdWVzdFVSTCggdXJsICkgKQogICAgICAgICBj b250aW51ZTsKIAotICAgICBrZERlYnVnKDcxMTMpIDw8ICIoIiA8PCBtX3BpZCA8PCAiKSBIVFRQ UHJvdG9jb2w6Om11bHRpX2dldCAiIDw8IHVybC51cmwoKSA8PCBlbmRsOworICAgICBrZERlYnVn KDcxMTMpIDw8ICIoIiA8PCBtX3BpZCA8PCAiKSBIVFRQUHJvdG9jb2w6Om11bHRpX2dldCAiIDw8 IHVybC5wcmV0dHlVUkwoKSA8PCBlbmRsOwogCiAgICAgIG1fcmVxdWVzdC5tZXRob2QgPSBIVFRQ X0dFVDsKICAgICAgbV9yZXF1ZXN0LnBhdGggPSB1cmwucGF0aCgpOwpAQCAtMjIxMiwxMiArMjIx NCwxMiBAQAogCiAgICAgIGlmIChiQ2FjaGVPbmx5KQogICAgICB7Ci0gICAgICAgIGVycm9yKCBF UlJfRE9FU19OT1RfRVhJU1QsIG1fcmVxdWVzdC51cmwudXJsKCkgKTsKKyAgICAgICAgZXJyb3Io IEVSUl9ET0VTX05PVF9FWElTVCwgbV9yZXF1ZXN0LnVybC5wcmV0dHlVUkwoKSApOwogICAgICAg ICByZXR1cm4gZmFsc2U7CiAgICAgIH0KICAgICAgaWYgKGJPZmZsaW5lKQogICAgICB7Ci0gICAg ICAgIGVycm9yKCBFUlJfQ09VTERfTk9UX0NPTk5FQ1QsIG1fcmVxdWVzdC51cmwudXJsKCkgKTsK KyAgICAgICAgZXJyb3IoIEVSUl9DT1VMRF9OT1RfQ09OTkVDVCwgbV9yZXF1ZXN0LnVybC5wcmV0 dHlVUkwoKSApOwogICAgICAgICByZXR1cm4gZmFsc2U7CiAgICAgIH0KICAgfQpAQCAtMjg5MSw3 ICsyODkzLDcgQEAKICAgICAgICAgICAgICAgZXJyb3JQYWdlKCk7CiAgICAgICAgICAgIGVsc2UK ICAgICAgICAgICAgewotICAgICAgICAgICAgICBlcnJvcihFUlJfSU5URVJOQUxfU0VSVkVSLCBt X3JlcXVlc3QudXJsLnVybCgpKTsKKyAgICAgICAgICAgICAgZXJyb3IoRVJSX0lOVEVSTkFMX1NF UlZFUiwgbV9yZXF1ZXN0LnVybC5wcmV0dHlVUkwoKSk7CiAgICAgICAgICAgICAgIHJldHVybiBm YWxzZTsKICAgICAgICAgICAgfQogICAgICAgICB9CkBAIC0yOTMxLDcgKzI5MzMsNyBAQAogICAg ICAgICAgIGVycm9yUGFnZSgpOwogICAgICAgICBlbHNlCiAgICAgICAgIHsKLSAgICAgICAgICBl cnJvcihFUlJfRE9FU19OT1RfRVhJU1QsIG1fcmVxdWVzdC51cmwudXJsKCkpOworICAgICAgICAg IGVycm9yKEVSUl9ET0VTX05PVF9FWElTVCwgbV9yZXF1ZXN0LnVybC5wcmV0dHlVUkwoKSk7CiAg ICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAgICAgICB9CiAgICAgICAgIG1fcmVxdWVzdC5iQ2Fj aGVkV3JpdGUgPSBmYWxzZTsgLy8gRG9uJ3QgcHV0IGluIGNhY2hlCkBAIC0zNTg0LDcgKzM1ODYs NyBAQAogICAgIEtVUkwgdShtX3JlcXVlc3QudXJsLCBsb2NhdGlvblN0cik7CiAgICAgaWYoIXUu aXNWYWxpZCgpKQogICAgIHsKLSAgICAgIGVycm9yKEVSUl9NQUxGT1JNRURfVVJMLCB1LnVybCgp KTsKKyAgICAgIGVycm9yKEVSUl9NQUxGT1JNRURfVVJMLCB1LnByZXR0eVVSTCgpKTsKICAgICAg IHJldHVybiBmYWxzZTsKICAgICB9CiAgICAgaWYgKCh1LnByb3RvY29sKCkgIT0gImh0dHAiKSAm JiAodS5wcm90b2NvbCgpICE9ICJodHRwcyIpICYmCkBAIC0zNTkyLDcgKzM1OTQsNyBAQAogICAg ICAgICh1LnByb3RvY29sKCkgIT0gIndlYmRhdnMiKSkKICAgICB7CiAgICAgICByZWRpcmVjdGlv bih1KTsKLSAgICAgIGVycm9yKEVSUl9BQ0NFU1NfREVOSUVELCB1LnVybCgpKTsKKyAgICAgIGVy cm9yKEVSUl9BQ0NFU1NfREVOSUVELCB1LnByZXR0eVVSTCgpKTsKICAgICAgIHJldHVybiBmYWxz ZTsKICAgICB9CiAKQEAgLTM2MTMsMTAgKzM2MTUsMTAgQEAKICAgICAgICBzZW5kTWV0YURhdGEo KTsKICAgICB9CiAKLSAgICBrZERlYnVnKDcxMTMpIDw8ICIoIiA8PCBtX3BpZCA8PCAiKSByZXF1 ZXN0LnVybDogIiA8PCBtX3JlcXVlc3QudXJsLnVybCgpCisgICAga2REZWJ1Zyg3MTEzKSA8PCAi KCIgPDwgbV9waWQgPDwgIikgcmVxdWVzdC51cmw6ICIgPDwgbV9yZXF1ZXN0LnVybC5wcmV0dHlV UkwoKQogICAgICAgICAgICAgICAgICAgPDwgZW5kbCA8PCAiTG9jYXRpb25TdHI6ICIgPDwgbG9j YXRpb25TdHIuZGF0YSgpIDw8IGVuZGw7CiAKLSAgICBrZERlYnVnKDcxMTMpIDw8ICIoIiA8PCBt X3BpZCA8PCAiKSBSZXF1ZXN0aW5nIHJlZGlyZWN0aW9uIHRvOiAiIDw8IHUudXJsKCkKKyAgICBr ZERlYnVnKDcxMTMpIDw8ICIoIiA8PCBtX3BpZCA8PCAiKSBSZXF1ZXN0aW5nIHJlZGlyZWN0aW9u IHRvOiAiIDw8IHUucHJldHR5VVJMKCkKICAgICAgICAgICAgICAgICAgIDw8IGVuZGw7CiAKICAg ICAvLyBJZiB3ZSdyZSByZWRpcmVjdGVkIHRvIGEgaHR0cDovLyB1cmwsIHJlbWVtYmVyIHRoYXQg d2UncmUgZG9pbmcgd2ViZGF2Li4uCkBAIC0zODMyLDcgKzM4MzQsNyBAQAogICAgICAgICBpZiAo IW1fcmVxdWVzdC5mY2FjaGUpCiAgICAgICAgIHsKICAgICAgICAgICBtX3JlcXVlc3QuYkNhY2hl ZFdyaXRlID0gZmFsc2U7IC8vIEVycm9yIGNyZWF0aW5nIGNhY2hlIGVudHJ5LgotICAgICAgICAg IGtkRGVidWcoNzExMykgPDwgIigiIDw8IG1fcGlkIDw8ICIpIEVycm9yIGNyZWF0aW5nIGNhY2hl IGVudHJ5IGZvciAiIDw8IG1fcmVxdWVzdC51cmwudXJsKCk8PCIhXG4iOworICAgICAgICAgIGtk RGVidWcoNzExMykgPDwgIigiIDw8IG1fcGlkIDw8ICIpIEVycm9yIGNyZWF0aW5nIGNhY2hlIGVu dHJ5IGZvciAiIDw8IG1fcmVxdWVzdC51cmwucHJldHR5VVJMKCk8PCIhXG4iOwogICAgICAgICB9 CiAgICAgICAgIG1fcmVxdWVzdC5leHBpcmVEYXRlID0gZXhwaXJlRGF0ZTsKICAgICAgICAgbV9t YXhDYWNoZVNpemUgPSBjb25maWcoKS0+cmVhZE51bUVudHJ5KCJNYXhDYWNoZVNpemUiLCBERUZB VUxUX01BWF9DQUNIRV9TSVpFKSAvIDI7CkBAIC0zODQwLDExICszODQyLDExIEBACiAgIH0KIAog ICBpZiAobV9yZXF1ZXN0LmJDYWNoZWRXcml0ZSAmJiAhbV9zdHJNaW1lVHlwZS5pc0VtcHR5KCkp Ci0gICAga2REZWJ1Zyg3MTEzKSA8PCAiKCIgPDwgbV9waWQgPDwgIikgQ2FjaGUsIGFkZGluZyBc IiIgPDwgbV9yZXF1ZXN0LnVybC51cmwoKSA8PCAiXCIiIDw8IGVuZGw7CisgICAga2REZWJ1Zyg3 MTEzKSA8PCAiKCIgPDwgbV9waWQgPDwgIikgQ2FjaGUsIGFkZGluZyBcIiIgPDwgbV9yZXF1ZXN0 LnVybC5wcmV0dHlVUkwoKSA8PCAiXCIiIDw8IGVuZGw7CiAgIGVsc2UgaWYgKG1fcmVxdWVzdC5i Q2FjaGVkV3JpdGUgJiYgbV9zdHJNaW1lVHlwZS5pc0VtcHR5KCkpCi0gICAga2REZWJ1Zyg3MTEz KSA8PCAiKCIgPDwgbV9waWQgPDwgIikgQ2FjaGUsIHBlbmRpbmcgXCIiIDw8IG1fcmVxdWVzdC51 cmwudXJsKCkgPDwgIlwiIiA8PCBlbmRsOworICAgIGtkRGVidWcoNzExMykgPDwgIigiIDw8IG1f cGlkIDw8ICIpIENhY2hlLCBwZW5kaW5nIFwiIiA8PCBtX3JlcXVlc3QudXJsLnByZXR0eVVSTCgp IDw8ICJcIiIgPDwgZW5kbDsKICAgZWxzZQotICAgIGtkRGVidWcoNzExMykgPDwgIigiIDw8IG1f cGlkIDw8ICIpIENhY2hlLCBub3QgYWRkaW5nIFwiIiA8PCBtX3JlcXVlc3QudXJsLnVybCgpIDw8 ICJcIiIgPDwgZW5kbDsKKyAgICBrZERlYnVnKDcxMTMpIDw8ICIoIiA8PCBtX3BpZCA8PCAiKSBD YWNoZSwgbm90IGFkZGluZyBcIiIgPDwgbV9yZXF1ZXN0LnVybC5wcmV0dHlVUkwoKSA8PCAiXCIi IDw8IGVuZGw7CiAgIHJldHVybiB0cnVlOwogfQogCg==