@oneuptime/common 12.0.25 → 12.0.26

package/Utils/SecurityEvent/ThreatIntel/StixPatternParser.ts

@@ -0,0 +1,383 @@
+import { ThreatIntelIndicatorType } from "../../../Types/SecurityEvent/ThreatIntelConstants";
+
+/*
+ * Parser for the subset of the STIX 2.1 pattern language that maps onto
+ * plain IOC equality — the shape the overwhelming majority of TAXII
+ * indicator feeds actually publish:
+ *
+ *   [ipv4-addr:value = '198.51.100.7']
+ *   [domain-name:value = 'evil.example' OR domain-name:value = 'evil2.example']
+ *   [file:hashes.'SHA-256' = 'aa...ff'] OR [url:value = 'http://evil.example/x']
+ *
+ * Supported: single-comparison and OR-combined equality comparisons over
+ * ipv4-addr/ipv6-addr/domain-name/url/email-addr values and file hashes
+ * (SHA-256, SHA-1, MD5), including multiple []-observation expressions
+ * joined by OR.
+ *
+ * Everything else — AND, FOLLOWEDBY, temporal qualifiers, negation, LIKE
+ * or MATCHES or set operators, and any other object path — returns null,
+ * deliberately all-or-nothing: a partially-translated AND pattern would
+ * match far MORE than its author intended, which for a detection feed is
+ * the dangerous direction. Callers count nulls and surface them as
+ * "unsupported patterns" on the feed instead of guessing.
+ *
+ * Pure and isomorphic (no server imports) so tests and any future UI
+ * validation share the exact implementation.
+ */
+
+export interface ParsedIndicatorValue {
+  type: ThreatIntelIndicatorType;
+  /*
+   * Canonical form: trimmed and lowercased. Observables are matched
+   * case-insensitively platform-wide (buildObservables dedupes case-
+   * insensitively), so indicators store the lowercase form once instead
+   * of every reader lowercasing per comparison.
+   */
+  value: string;
+}
+
+/*
+ * Pattern-language words whose presence (outside string literals) makes a
+ * pattern unsupported. NOT catches negation; the comparison regex already
+ * rejects operators like != or LIKE that attach without whitespace.
+ */
+const UNSUPPORTED_WORDS_REGEX: RegExp =
+  /\b(AND|FOLLOWEDBY|WITHIN|REPEATS|START|STOP|NOT|LIKE|MATCHES|ISSUBSET|ISSUPERSET|IN|EXISTS)\b/i;
+
+const OR_WORD_REGEX: RegExp = /\bOR\b/gi;
+
+// A between-groups connector must be exactly the word OR.
+const OR_CONNECTOR_REGEX: RegExp = /^OR$/i;
+
+const COMPARISON_REGEX: RegExp =
+  /^([a-zA-Z0-9-]+):([A-Za-z0-9_.'"-]+)\s*=\s*'((?:\\.|[^'\\])*)'$/;
+
+const HASH_KEY_TO_TYPE: Record<string, ThreatIntelIndicatorType> = {
+  SHA256: ThreatIntelIndicatorType.FileHashSha256,
+  SHA1: ThreatIntelIndicatorType.FileHashSha1,
+  MD5: ThreatIntelIndicatorType.FileHashMd5,
+};
+
+export default class StixPatternParser {
+  /*
+   * Parse a STIX pattern into normalized indicator values, or null when
+   * any part of the pattern falls outside the supported subset.
+   */
+  public static parse(pattern: string): Array<ParsedIndicatorValue> | null {
+    const trimmed: string = (pattern || "").trim();
+
+    if (!trimmed) {
+      return null;
+    }
+
+    const masked: string | null = this.maskStringLiterals(trimmed);
+
+    if (masked === null) {
+      // Unterminated string literal.
+      return null;
+    }
+
+    const groups: Array<string> | null = this.extractObservationExpressions(
+      trimmed,
+      masked,
+    );
+
+    if (groups === null) {
+      return null;
+    }
+
+    const values: Array<ParsedIndicatorValue> = [];
+    const seen: Set<string> = new Set<string>();
+
+    for (const group of groups) {
+      const groupValues: Array<ParsedIndicatorValue> | null =
+        this.parseObservationExpression(group);
+
+      if (groupValues === null) {
+        return null;
+      }
+
+      for (const parsed of groupValues) {
+        const dedupeKey: string = `${parsed.type}|${parsed.value}`;
+
+        if (seen.has(dedupeKey)) {
+          continue;
+        }
+
+        seen.add(dedupeKey);
+        values.push(parsed);
+      }
+    }
+
+    return values.length > 0 ? values : null;
+  }
+
+  /*
+   * Replace the contents of every single-quoted literal with '#' so word
+   * and bracket scanning cannot be fooled by values containing " OR " or
+   * "]". Indexes are preserved (same length), so positions found on the
+   * masked string address the original. Returns null on an unterminated
+   * literal.
+   */
+  private static maskStringLiterals(input: string): string | null {
+    const out: Array<string> = [];
+    let inQuote: boolean = false;
+
+    for (let i: number = 0; i < input.length; i++) {
+      const char: string = input[i]!;
+
+      if (!inQuote) {
+        out.push(char);
+        if (char === "'") {
+          inQuote = true;
+        }
+        continue;
+      }
+
+      if (char === "\\") {
+        // Escape sequence inside the literal: mask both characters.
+        out.push("#");
+        if (i + 1 < input.length) {
+          out.push("#");
+          i++;
+        }
+        continue;
+      }
+
+      if (char === "'") {
+        out.push(char);
+        inQuote = false;
+        continue;
+      }
+
+      out.push("#");
+    }
+
+    return inQuote ? null : out.join("");
+  }
+
+  /*
+   * Split the top level of the pattern into its []-observation
+   * expressions, requiring every connector between them to be OR and
+   * nothing but whitespace otherwise (no qualifiers, no parentheses
+   * combining groups with AND). Returns the ORIGINAL (unmasked) bracket
+   * contents.
+   */
+  private static extractObservationExpressions(
+    original: string,
+    masked: string,
+  ): Array<string> | null {
+    const groups: Array<string> = [];
+    const connectors: Array<string> = [];
+    let depth: number = 0;
+    let groupStart: number = -1;
+    let connectorStart: number = 0;
+
+    for (let i: number = 0; i < masked.length; i++) {
+      const char: string = masked[i]!;
+
+      if (char === "[") {
+        if (depth === 0) {
+          connectors.push(masked.slice(connectorStart, i));
+          groupStart = i + 1;
+        }
+        depth++;
+        continue;
+      }
+
+      if (char === "]") {
+        depth--;
+
+        if (depth < 0) {
+          return null;
+        }
+
+        if (depth === 0) {
+          groups.push(original.slice(groupStart, i));
+          connectorStart = i + 1;
+        }
+        continue;
+      }
+    }
+
+    if (depth !== 0 || groups.length === 0) {
+      return null;
+    }
+
+    connectors.push(masked.slice(connectorStart));
+
+    for (let i: number = 0; i < connectors.length; i++) {
+      const connector: string = connectors[i]!.trim();
+
+      if (i === 0 || i === connectors.length - 1) {
+        // Before the first group / after the last: whitespace only.
+        if (connector !== "") {
+          return null;
+        }
+        continue;
+      }
+
+      if (!OR_CONNECTOR_REGEX.test(connector)) {
+        return null;
+      }
+    }
+
+    return groups;
+  }
+
+  /*
+   * Parse the inside of one [...] group: equality comparisons joined by
+   * OR. Any unsupported word, operator, or object path fails the whole
+   * pattern.
+   */
+  private static parseObservationExpression(
+    group: string,
+  ): Array<ParsedIndicatorValue> | null {
+    const masked: string | null = this.maskStringLiterals(group);
+
+    if (masked === null) {
+      return null;
+    }
+
+    if (UNSUPPORTED_WORDS_REGEX.test(masked)) {
+      return null;
+    }
+
+    // Split at top-level ORs, positions taken from the masked copy.
+    const segments: Array<string> = [];
+    let lastIndex: number = 0;
+
+    OR_WORD_REGEX.lastIndex = 0;
+    let match: RegExpExecArray | null = OR_WORD_REGEX.exec(masked);
+
+    while (match !== null) {
+      segments.push(group.slice(lastIndex, match.index));
+      lastIndex = match.index + match[0].length;
+      match = OR_WORD_REGEX.exec(masked);
+    }
+
+    segments.push(group.slice(lastIndex));
+
+    const values: Array<ParsedIndicatorValue> = [];
+
+    for (const segment of segments) {
+      const parsed: ParsedIndicatorValue | null = this.parseComparison(
+        segment.trim(),
+      );
+
+      if (parsed === null) {
+        return null;
+      }
+
+      values.push(parsed);
+    }
+
+    return values;
+  }
+
+  private static parseComparison(
+    comparison: string,
+  ): ParsedIndicatorValue | null {
+    let unwrapped: string = comparison;
+
+    // Tolerate redundant parentheses around a single comparison.
+    while (
+      unwrapped.startsWith("(") &&
+      unwrapped.endsWith(")") &&
+      this.isBalancedWrap(unwrapped)
+    ) {
+      unwrapped = unwrapped.slice(1, -1).trim();
+    }
+
+    const match: RegExpMatchArray | null = unwrapped.match(COMPARISON_REGEX);
+
+    if (!match) {
+      return null;
+    }
+
+    const objectType: string = match[1]!.toLowerCase();
+    const propertyPath: string = match[2]!;
+    const rawValue: string = match[3]!;
+
+    const type: ThreatIntelIndicatorType | null = this.resolveIndicatorType(
+      objectType,
+      propertyPath,
+    );
+
+    if (type === null) {
+      return null;
+    }
+
+    const value: string = this.unescapeLiteral(rawValue).trim().toLowerCase();
+
+    if (!value) {
+      return null;
+    }
+
+    return { type, value };
+  }
+
+  private static resolveIndicatorType(
+    objectType: string,
+    propertyPath: string,
+  ): ThreatIntelIndicatorType | null {
+    if (propertyPath === "value") {
+      switch (objectType) {
+        case "ipv4-addr":
+          return ThreatIntelIndicatorType.Ipv4Address;
+        case "ipv6-addr":
+          return ThreatIntelIndicatorType.Ipv6Address;
+        case "domain-name":
+          return ThreatIntelIndicatorType.DomainName;
+        case "url":
+          return ThreatIntelIndicatorType.Url;
+        case "email-addr":
+          return ThreatIntelIndicatorType.EmailAddress;
+        default:
+          return null;
+      }
+    }
+
+    if (objectType === "file") {
+      // file:hashes.'SHA-256' / file:hashes."SHA-1" / file:hashes.MD5
+      const hashMatch: RegExpMatchArray | null = propertyPath.match(
+        /^hashes\.['"]?([A-Za-z0-9-]+)['"]?$/,
+      );
+
+      if (!hashMatch) {
+        return null;
+      }
+
+      const hashKey: string = hashMatch[1]!.toUpperCase().replace(/-/g, "");
+
+      return HASH_KEY_TO_TYPE[hashKey] || null;
+    }
+
+    return null;
+  }
+
+  /*
+   * True when the leading "(" closes at the final character — i.e. the
+   * parentheses wrap the whole string rather than two adjacent groups.
+   */
+  private static isBalancedWrap(input: string): boolean {
+    let depth: number = 0;
+
+    for (let i: number = 0; i < input.length; i++) {
+      if (input[i] === "(") {
+        depth++;
+      } else if (input[i] === ")") {
+        depth--;
+        if (depth === 0) {
+          return i === input.length - 1;
+        }
+      }
+    }
+
+    return false;
+  }
+
+  private static unescapeLiteral(value: string): string {
+    return value.replace(/\\(.)/g, "$1");
+  }
+}

package/Utils/Telemetry/CrossSignalScope.ts

@@ -10,15 +10,23 @@ import MetricExplorerUrl, {
   MetricExplorerUrlParam,
   SerializedMetricQuery,
 } from "../Metrics/MetricExplorerUrl";
+import { buildSearchTokenValue } from "../../Types/Telemetry/TelemetrySearchQuery";
 
 /*
  * Matches any whitespace, double-quote, or colon — the characters that break a
- * bare traces search token. Kept as named consts so the linter doesn't fight
- * over wrapping an inline regex literal used with .test() (wrap-regex vs
- * prettier).
+ * bare traces search token KEY (the grammar escapes values, but a key is read
+ * up to the first colon and cannot be quoted). Kept as a named const so the
+ * linter doesn't fight over wrapping an inline regex literal used with .test()
+ * (wrap-regex vs prettier).
  */
 const TRACE_TOKEN_UNSAFE_CHARS: RegExp = /[\s":]/;
-const WHITESPACE: RegExp = /\s/;
+
+/*
+ * A literal percent cannot ride the traces `search` param: TracesViewer
+ * decodeURIComponent()s it a SECOND time (readInitialUrlState, on the value
+ * URLSearchParams already decoded), so "a%20b" would arrive as "a b".
+ */
+const PERCENT: RegExp = /%/;
 
 /*
  * Cross-signal scope translation: turn one description of "what slice of
@@ -41,12 +49,15 @@ const WHITESPACE: RegExp = /\s/;
  *    `end` (parsed with `new Date(...)`). There is no `search` param.
  *
  *  - Traces explorer (App/FeatureSet/Dashboard/src/Components/Traces/
- *    TracesViewer.tsx, readInitialUrlState + parseSearch): `search` is a
- *    Datadog-style DSL (`trace:<id>`, `span:<id>`, `@<attr>:<value>`, with
- *    double quotes around values containing spaces); `filters` is a JSON
- *    array of [facetKey, value] string pairs where facetKey may be
- *    `primaryEntityId` (service ObjectID) or `attributes.<key>`;
- *    `range`/`start`/`end` follow the same Custom convention as logs.
+ *    TracesViewer.tsx, readInitialUrlState + TracesSearchCompile): `search`
+ *    is the shared telemetry grammar (Types/Telemetry/TelemetrySearchQuery)
+ *    with the trace field names — `trace:<id>`, `span:<id>`,
+ *    `@<attr>:<value>` — so values are escaped by that grammar's own
+ *    buildSearchTokenValue rather than by rules restated here. `filters` is a
+ *    JSON array of [facetKey, value] string pairs where facetKey may be
+ *    `primaryEntityId` (service ObjectID) or `attributes.<key>`; an
+ *    `attributes.` chip value is re-parsed by the grammar, so it is escaped
+ *    too. `range`/`start`/`end` follow the same Custom convention as logs.
  *
  *  - Metric explorer (Common/Utils/Metrics/MetricExplorerUrl.ts): the
  *    JSON-encoded `metricQueries` param plus absolute `startTime`/`endTime`
@@ -391,39 +402,20 @@ function isTraceTokenSafeKey(key: string): boolean {
 /*
  * Whether a value can ride in a traces search token, and how.
  *
- *  - values with whitespace get double-quoted (`@k:"a b"` — the tokenizer's
- *    quoted-token branch);
- *  - values containing a double quote cannot be represented (the grammar
- *    has no escape sequence — `"[^"]*"` stops at the first quote);
- *  - values starting with "~" would flip an exact match into the
- *    contains-match operator (quoting does NOT protect it: parseSearch
- *    strips quotes before the startsWith("~") check);
- *  - values containing "%" risk corruption because TracesViewer
- *    double-decodes the `search` param (decodeURIComponent on the already-
- *    decoded value, TracesViewer.tsx readInitialUrlState) — "a%20b" would
- *    come out as "a b".
- *
- * Unrepresentable values fall back to a `filters` chip, which is plain JSON
- * and can carry anything.
+ * The escaping is the shared search grammar's own
+ * ({@link buildSearchTokenValue}), which is what the traces explorer now
+ * parses with: quotes, wildcards, a leading `~` and a leading `-` all have
+ * escapes, so the quote / tilde values that used to need a chip fallback ride
+ * a token intact. Only a literal percent still cannot — that is a URL
+ * round-trip problem, not a grammar one — and falls back to a `filters` chip,
+ * which is plain JSON and can carry anything.
  */
 function buildTraceSearchTokenValue(value: string): string | null {
-  if (value.includes('"')) {
-    return null;
-  }
-
-  if (value.includes("%")) {
-    return null;
-  }
-
-  if (value.startsWith("~")) {
+  if (PERCENT.test(value)) {
     return null;
   }
 
-  if (WHITESPACE.test(value)) {
-    return `"${value}"`;
-  }
-
-  return value;
+  return buildSearchTokenValue(value);
 }
 
 /**
@@ -475,7 +467,13 @@ export function toTracesExplorerQueryParams(
     if (tokenValue !== null) {
       searchTokens.push(`@${key}:${tokenValue}`);
     } else {
-      filterTuples.push([`attributes.${key}`, value]);
+      /*
+       * An `attributes.<key>` chip is re-parsed by the same grammar when the
+       * explorer builds its query, so the fallback carries an escaped token
+       * too — a raw `99%` is inert, but a raw `/api/*` would come back as a
+       * wildcard matching far more than the scope asked for.
+       */
+      filterTuples.push([`attributes.${key}`, buildSearchTokenValue(value)]);
     }
   }
 

package/build/dist/Models/AnalyticsModels/Index.js

@@ -21,6 +21,7 @@ import RumSession from "./RumSession";
 import RumSessionChunk from "./RumSessionChunk";
 import AuditLog from "./AuditLog";
 import ChangeEvent from "./ChangeEvent";
+import ThreatIntelIndicator from "./ThreatIntelIndicator";
 const AnalyticsModels = [
     Log,
     Span,
@@ -69,6 +70,7 @@ const AnalyticsModels = [
     AuditLog,
     SecurityEvent,
     ChangeEvent,
+    ThreatIntelIndicator,
 ];
 const modelTypeMap = {};
 export const getModelTypeByName = (tableName) => {

package/build/dist/Models/AnalyticsModels/Index.js.map

@@ -1 +1 @@
-{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../../../Models/AnalyticsModels/Index.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,OAAO,CAAC;AACxB,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,yBAAyB,MAAM,6BAA6B,CAAC;AACpE,OAAO,0BAA0B,MAAM,8BAA8B,CAAC;AACtE,OAAO,6BAA6B,MAAM,iCAAiC,CAAC;AAC5E,OAAO,4BAA4B,MAAM,gCAAgC,CAAC;AAC1E,OAAO,oBAAoB,MAAM,wBAAwB,CAAC;AAC1D,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC1B,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,wBAAwB,MAAM,4BAA4B,CAAC;AAClE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,QAAQ,MAAM,YAAY,CAAC;AAClC,OAAO,WAAW,MAAM,eAAe,CAAC;AAExC,MAAM,eAAe,GAA0C;IAC7D,GAAG;IACH,IAAI;IACJ,MAAM;IACN;;;OAGG;IACH,iBAAiB;IACjB;;;;OAIG;IACH,yBAAyB;IACzB;;;;OAIG;IACH,0BAA0B;IAC1B,6BAA6B;IAC7B,4BAA4B;IAC5B,oBAAoB;IACpB;;;OAGG;IACH,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,WAAW;IACX,wBAAwB;IACxB,OAAO;IACP,aAAa;IACb;;;;;OAKG;IACH,UAAU;IACV,eAAe;IACf,QAAQ;IACR,aAAa;IACb,WAAW;CACZ,CAAC;AAEF,MAAM,YAAY,GAAsD,EAAE,CAAC;AAM3E,MAAM,CAAC,MAAM,kBAAkB,GAAuB,CACpD,SAAiB,EACsB,EAAE;IACzC,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,GACb,eAAe,CAAC,IAAI,CAAC,CAAC,SAAyC,EAAE,EAAE;QACjE,OAAO,IAAI,SAAS,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;IACjD,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAEpC,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}
+{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../../../Models/AnalyticsModels/Index.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,OAAO,CAAC;AACxB,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,yBAAyB,MAAM,6BAA6B,CAAC;AACpE,OAAO,0BAA0B,MAAM,8BAA8B,CAAC;AACtE,OAAO,6BAA6B,MAAM,iCAAiC,CAAC;AAC5E,OAAO,4BAA4B,MAAM,gCAAgC,CAAC;AAC1E,OAAO,oBAAoB,MAAM,wBAAwB,CAAC;AAC1D,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC1B,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,wBAAwB,MAAM,4BAA4B,CAAC;AAClE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,QAAQ,MAAM,YAAY,CAAC;AAClC,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,oBAAoB,MAAM,wBAAwB,CAAC;AAE1D,MAAM,eAAe,GAA0C;IAC7D,GAAG;IACH,IAAI;IACJ,MAAM;IACN;;;OAGG;IACH,iBAAiB;IACjB;;;;OAIG;IACH,yBAAyB;IACzB;;;;OAIG;IACH,0BAA0B;IAC1B,6BAA6B;IAC7B,4BAA4B;IAC5B,oBAAoB;IACpB;;;OAGG;IACH,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,WAAW;IACX,wBAAwB;IACxB,OAAO;IACP,aAAa;IACb;;;;;OAKG;IACH,UAAU;IACV,eAAe;IACf,QAAQ;IACR,aAAa;IACb,WAAW;IACX,oBAAoB;CACrB,CAAC;AAEF,MAAM,YAAY,GAAsD,EAAE,CAAC;AAM3E,MAAM,CAAC,MAAM,kBAAkB,GAAuB,CACpD,SAAiB,EACsB,EAAE;IACzC,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,GACb,eAAe,CAAC,IAAI,CAAC,CAAC,SAAyC,EAAE,EAAE;QACjE,OAAO,IAAI,SAAS,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;IACjD,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAEpC,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}