@sikkuumiii/defuse 0.0.0-stage → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (236) hide show
  1. package/LICENSE +235 -0
  2. package/README.md +561 -2
  3. package/dist/src/cli.d.ts +20 -0
  4. package/dist/src/cli.js +619 -0
  5. package/dist/src/cli.js.map +1 -0
  6. package/dist/src/core/analyze.d.ts +178 -0
  7. package/dist/src/core/analyze.js +834 -0
  8. package/dist/src/core/analyze.js.map +1 -0
  9. package/dist/src/core/coverage.d.ts +87 -0
  10. package/dist/src/core/coverage.js +181 -0
  11. package/dist/src/core/coverage.js.map +1 -0
  12. package/dist/src/core/finding.d.ts +196 -0
  13. package/dist/src/core/finding.js +178 -0
  14. package/dist/src/core/finding.js.map +1 -0
  15. package/dist/src/core/licence.d.ts +50 -0
  16. package/dist/src/core/licence.js +56 -0
  17. package/dist/src/core/licence.js.map +1 -0
  18. package/dist/src/core/paths.d.ts +21 -0
  19. package/dist/src/core/paths.js +58 -0
  20. package/dist/src/core/paths.js.map +1 -0
  21. package/dist/src/core/score.d.ts +137 -0
  22. package/dist/src/core/score.js +232 -0
  23. package/dist/src/core/score.js.map +1 -0
  24. package/dist/src/dast/targets.d.ts +30 -0
  25. package/dist/src/dast/targets.js +79 -0
  26. package/dist/src/dast/targets.js.map +1 -0
  27. package/dist/src/dast/zap.d.ts +42 -0
  28. package/dist/src/dast/zap.js +184 -0
  29. package/dist/src/dast/zap.js.map +1 -0
  30. package/dist/src/engine/scan.d.ts +80 -0
  31. package/dist/src/engine/scan.js +129 -0
  32. package/dist/src/engine/scan.js.map +1 -0
  33. package/dist/src/engine/shapes.d.ts +47 -0
  34. package/dist/src/engine/shapes.js +328 -0
  35. package/dist/src/engine/shapes.js.map +1 -0
  36. package/dist/src/engine/walk.d.ts +60 -0
  37. package/dist/src/engine/walk.js +156 -0
  38. package/dist/src/engine/walk.js.map +1 -0
  39. package/dist/src/parse/astDump.d.ts +31 -0
  40. package/dist/src/parse/astDump.js +66 -0
  41. package/dist/src/parse/astDump.js.map +1 -0
  42. package/dist/src/parse/languages.d.ts +70 -0
  43. package/dist/src/parse/languages.js +174 -0
  44. package/dist/src/parse/languages.js.map +1 -0
  45. package/dist/src/parse/location.d.ts +17 -0
  46. package/dist/src/parse/location.js +38 -0
  47. package/dist/src/parse/location.js.map +1 -0
  48. package/dist/src/parse/node-grammars.d.ts +12 -0
  49. package/dist/src/parse/node-grammars.js +35 -0
  50. package/dist/src/parse/node-grammars.js.map +1 -0
  51. package/dist/src/parse/parser.d.ts +126 -0
  52. package/dist/src/parse/parser.js +202 -0
  53. package/dist/src/parse/parser.js.map +1 -0
  54. package/dist/src/parse/tree-store.d.ts +139 -0
  55. package/dist/src/parse/tree-store.js +236 -0
  56. package/dist/src/parse/tree-store.js.map +1 -0
  57. package/dist/src/platform/dependency-rule.d.ts +27 -0
  58. package/dist/src/platform/dependency-rule.js +21 -0
  59. package/dist/src/platform/dependency-rule.js.map +1 -0
  60. package/dist/src/platform/deps.d.ts +86 -0
  61. package/dist/src/platform/deps.js +304 -0
  62. package/dist/src/platform/deps.js.map +1 -0
  63. package/dist/src/platform/php-facts.d.ts +49 -0
  64. package/dist/src/platform/php-facts.js +67 -0
  65. package/dist/src/platform/php-facts.js.map +1 -0
  66. package/dist/src/platform/runtime-version.d.ts +78 -0
  67. package/dist/src/platform/runtime-version.js +573 -0
  68. package/dist/src/platform/runtime-version.js.map +1 -0
  69. package/dist/src/report/colors.d.ts +50 -0
  70. package/dist/src/report/colors.js +97 -0
  71. package/dist/src/report/colors.js.map +1 -0
  72. package/dist/src/report/coverage-table.d.ts +90 -0
  73. package/dist/src/report/coverage-table.js +291 -0
  74. package/dist/src/report/coverage-table.js.map +1 -0
  75. package/dist/src/report/html-report.d.ts +66 -0
  76. package/dist/src/report/html-report.js +489 -0
  77. package/dist/src/report/html-report.js.map +1 -0
  78. package/dist/src/report/human.d.ts +44 -0
  79. package/dist/src/report/human.js +575 -0
  80. package/dist/src/report/human.js.map +1 -0
  81. package/dist/src/report/json.d.ts +24 -0
  82. package/dist/src/report/json.js +178 -0
  83. package/dist/src/report/json.js.map +1 -0
  84. package/dist/src/report/mark.d.ts +17 -0
  85. package/dist/src/report/mark.js +39 -0
  86. package/dist/src/report/mark.js.map +1 -0
  87. package/dist/src/report/pricing.d.ts +33 -0
  88. package/dist/src/report/pricing.js +343 -0
  89. package/dist/src/report/pricing.js.map +1 -0
  90. package/dist/src/report/sarif.d.ts +39 -0
  91. package/dist/src/report/sarif.js +219 -0
  92. package/dist/src/report/sarif.js.map +1 -0
  93. package/dist/src/report/site.d.ts +87 -0
  94. package/dist/src/report/site.js +742 -0
  95. package/dist/src/report/site.js.map +1 -0
  96. package/dist/src/rules/code-injection.d.ts +47 -0
  97. package/dist/src/rules/code-injection.js +326 -0
  98. package/dist/src/rules/code-injection.js.map +1 -0
  99. package/dist/src/rules/command-injection.d.ts +30 -0
  100. package/dist/src/rules/command-injection.js +286 -0
  101. package/dist/src/rules/command-injection.js.map +1 -0
  102. package/dist/src/rules/contract.d.ts +198 -0
  103. package/dist/src/rules/contract.js +39 -0
  104. package/dist/src/rules/contract.js.map +1 -0
  105. package/dist/src/rules/format-string.d.ts +46 -0
  106. package/dist/src/rules/format-string.js +146 -0
  107. package/dist/src/rules/format-string.js.map +1 -0
  108. package/dist/src/rules/hardcoded-secret.d.ts +38 -0
  109. package/dist/src/rules/hardcoded-secret.js +440 -0
  110. package/dist/src/rules/hardcoded-secret.js.map +1 -0
  111. package/dist/src/rules/lib/guards.d.ts +168 -0
  112. package/dist/src/rules/lib/guards.js +1179 -0
  113. package/dist/src/rules/lib/guards.js.map +1 -0
  114. package/dist/src/rules/lib/html-safety.d.ts +75 -0
  115. package/dist/src/rules/lib/html-safety.js +755 -0
  116. package/dist/src/rules/lib/html-safety.js.map +1 -0
  117. package/dist/src/rules/lib/local-build.d.ts +59 -0
  118. package/dist/src/rules/lib/local-build.js +320 -0
  119. package/dist/src/rules/lib/local-build.js.map +1 -0
  120. package/dist/src/rules/lib/strings.d.ts +208 -0
  121. package/dist/src/rules/lib/strings.js +1970 -0
  122. package/dist/src/rules/lib/strings.js.map +1 -0
  123. package/dist/src/rules/path-traversal.d.ts +33 -0
  124. package/dist/src/rules/path-traversal.js +96 -0
  125. package/dist/src/rules/path-traversal.js.map +1 -0
  126. package/dist/src/rules/registry.d.ts +19 -0
  127. package/dist/src/rules/registry.js +77 -0
  128. package/dist/src/rules/registry.js.map +1 -0
  129. package/dist/src/rules/sql-injection.d.ts +36 -0
  130. package/dist/src/rules/sql-injection.js +299 -0
  131. package/dist/src/rules/sql-injection.js.map +1 -0
  132. package/dist/src/rules/ssrf.d.ts +39 -0
  133. package/dist/src/rules/ssrf.js +111 -0
  134. package/dist/src/rules/ssrf.js.map +1 -0
  135. package/dist/src/rules/unbounded-copy.d.ts +37 -0
  136. package/dist/src/rules/unbounded-copy.js +147 -0
  137. package/dist/src/rules/unbounded-copy.js.map +1 -0
  138. package/dist/src/rules/unsafe-deserialization.d.ts +43 -0
  139. package/dist/src/rules/unsafe-deserialization.js +276 -0
  140. package/dist/src/rules/unsafe-deserialization.js.map +1 -0
  141. package/dist/src/rules/weak-hash.d.ts +37 -0
  142. package/dist/src/rules/weak-hash.js +197 -0
  143. package/dist/src/rules/weak-hash.js.map +1 -0
  144. package/dist/src/rules/xss.d.ts +38 -0
  145. package/dist/src/rules/xss.js +527 -0
  146. package/dist/src/rules/xss.js.map +1 -0
  147. package/dist/src/taint/content-type.d.ts +19 -0
  148. package/dist/src/taint/content-type.js +20 -0
  149. package/dist/src/taint/content-type.js.map +1 -0
  150. package/dist/src/taint/dictionaries.d.ts +23 -0
  151. package/dist/src/taint/dictionaries.js +1778 -0
  152. package/dist/src/taint/dictionaries.js.map +1 -0
  153. package/dist/src/taint/fold.d.ts +59 -0
  154. package/dist/src/taint/fold.js +1177 -0
  155. package/dist/src/taint/fold.js.map +1 -0
  156. package/dist/src/taint/java-scope.d.ts +61 -0
  157. package/dist/src/taint/java-scope.js +212 -0
  158. package/dist/src/taint/java-scope.js.map +1 -0
  159. package/dist/src/taint/local-map.d.ts +79 -0
  160. package/dist/src/taint/local-map.js +603 -0
  161. package/dist/src/taint/local-map.js.map +1 -0
  162. package/dist/src/taint/project.d.ts +172 -0
  163. package/dist/src/taint/project.js +617 -0
  164. package/dist/src/taint/project.js.map +1 -0
  165. package/dist/src/taint/tracer.d.ts +265 -0
  166. package/dist/src/taint/tracer.js +3817 -0
  167. package/dist/src/taint/tracer.js.map +1 -0
  168. package/dist/src/taint/types.d.ts +484 -0
  169. package/dist/src/taint/types.js +47 -0
  170. package/dist/src/taint/types.js.map +1 -0
  171. package/dist/src/taint/visibility.d.ts +25 -0
  172. package/dist/src/taint/visibility.js +96 -0
  173. package/dist/src/taint/visibility.js.map +1 -0
  174. package/docs/examples/defuse.json +20 -0
  175. package/docs/examples/dvwa-urls.json +14 -0
  176. package/docs/examples/github-code-scanning.yml +54 -0
  177. package/docs/examples/tiny.js +4 -0
  178. package/package.json +73 -4
  179. package/src/cli.ts +747 -0
  180. package/src/core/analyze.ts +1072 -0
  181. package/src/core/coverage.ts +269 -0
  182. package/src/core/finding.ts +311 -0
  183. package/src/core/licence.ts +61 -0
  184. package/src/core/paths.ts +59 -0
  185. package/src/core/score.ts +353 -0
  186. package/src/dast/targets.ts +121 -0
  187. package/src/dast/zap.ts +246 -0
  188. package/src/engine/scan.ts +200 -0
  189. package/src/engine/shapes.ts +348 -0
  190. package/src/engine/walk.ts +196 -0
  191. package/src/parse/astDump.ts +85 -0
  192. package/src/parse/languages.ts +232 -0
  193. package/src/parse/location.ts +44 -0
  194. package/src/parse/node-grammars.ts +41 -0
  195. package/src/parse/parser.ts +262 -0
  196. package/src/parse/tree-store.ts +301 -0
  197. package/src/platform/dependency-rule.ts +33 -0
  198. package/src/platform/deps.ts +374 -0
  199. package/src/platform/php-facts.ts +85 -0
  200. package/src/platform/runtime-version.ts +710 -0
  201. package/src/report/colors.ts +107 -0
  202. package/src/report/coverage-table.ts +359 -0
  203. package/src/report/html-report.ts +601 -0
  204. package/src/report/human.ts +811 -0
  205. package/src/report/json.ts +189 -0
  206. package/src/report/mark.ts +47 -0
  207. package/src/report/pricing.ts +374 -0
  208. package/src/report/sarif.ts +235 -0
  209. package/src/report/site.ts +760 -0
  210. package/src/rules/code-injection.ts +346 -0
  211. package/src/rules/command-injection.ts +296 -0
  212. package/src/rules/contract.ts +220 -0
  213. package/src/rules/format-string.ts +158 -0
  214. package/src/rules/hardcoded-secret.ts +485 -0
  215. package/src/rules/lib/guards.ts +1235 -0
  216. package/src/rules/lib/html-safety.ts +793 -0
  217. package/src/rules/lib/local-build.ts +329 -0
  218. package/src/rules/lib/strings.ts +2034 -0
  219. package/src/rules/path-traversal.ts +101 -0
  220. package/src/rules/registry.ts +90 -0
  221. package/src/rules/sql-injection.ts +311 -0
  222. package/src/rules/ssrf.ts +118 -0
  223. package/src/rules/unbounded-copy.ts +162 -0
  224. package/src/rules/unsafe-deserialization.ts +291 -0
  225. package/src/rules/weak-hash.ts +226 -0
  226. package/src/rules/xss.ts +572 -0
  227. package/src/taint/content-type.ts +20 -0
  228. package/src/taint/dictionaries.ts +1855 -0
  229. package/src/taint/fold.ts +1206 -0
  230. package/src/taint/java-scope.ts +200 -0
  231. package/src/taint/local-map.ts +594 -0
  232. package/src/taint/project.ts +774 -0
  233. package/src/taint/tracer.ts +4298 -0
  234. package/src/taint/types.ts +511 -0
  235. package/src/taint/visibility.ts +100 -0
  236. package/tsconfig.json +61 -0
@@ -0,0 +1,603 @@
1
+ /**
2
+ * WHAT A LOCAL MAP GIVES BACK UNDER A KEY - WHEN THAT IS A FACT.
3
+ *
4
+ * The tracer taints a collection whole: one dirty `put` and every `get` comes
5
+ * back dirty, marked as a guess about which element was read. That is the
6
+ * right default, because in general a map's contents are not on the page -
7
+ * it can be passed to a helper, filled by a framework, iterated, merged.
8
+ *
9
+ * keyed-container.java refuses to match keys for exactly that reason, on a
10
+ * request's attributes: filters and frameworks the scan never sees can write
11
+ * under the same name, so matching the key would be a guess.
12
+ *
13
+ * This module answers the narrow case where it is NOT a guess, and declines
14
+ * everything else. Java only, and only when every write the map can ever
15
+ * receive is visible right here:
16
+ *
17
+ * - declared in this block as `new HashMap<...>()` or `new LinkedHashMap<...>()`
18
+ * with no arguments (a copy constructor would bring in contents unseen);
19
+ * - every mention of it is `map.put("literal", value);` as its OWN statement
20
+ * directly in that block - never under an if, a loop or a try, so each put
21
+ * certainly runs - or a read (`get`, `containsKey`, `size`, `isEmpty`);
22
+ * - it is never passed, returned, assigned, iterated, captured by anything
23
+ * that writes to it, or touched by any other method;
24
+ * - the read is not inside a lambda or an inner class, which could run after
25
+ * puts that come later in the text;
26
+ * - some put under that key comes before the read. The last one is the value.
27
+ *
28
+ * Keys are compared as literal text, and only literals with no escapes: two
29
+ * Java string literals are equal() exactly when their characters match, and a
30
+ * HashMap uses equals(). A TreeMap with a comparator does not, which is one of
31
+ * the reasons only the two hash maps are accepted.
32
+ */
33
+ const MAP_TYPE = /^(?:java\.util\.)?(?:HashMap|LinkedHashMap)\s*(?:<[^>]*>)?$/;
34
+ const PLAIN_KEY = /^"([^"\\]*)"$/;
35
+ const READ_ONLY = new Set(['get', 'containsKey', 'containsValue', 'size', 'isEmpty']);
36
+ const FUNCTION_BOUNDARY = /^(?:method_declaration|constructor_declaration|lambda_expression|class_body)$/;
37
+ const named = (n) => (n?.namedChildren ?? []).filter((c) => c !== null);
38
+ const sameSpan = (a, b) => !!a && !!b && a.startIndex === b.startIndex && a.endIndex === b.endIndex;
39
+ /** The literal key of a one-argument call, or null. */
40
+ function literalKey(args, index) {
41
+ const arg = args[index];
42
+ if (!arg || arg.type !== 'string_literal')
43
+ return null;
44
+ const match = PLAIN_KEY.exec(arg.text);
45
+ return match?.[1] ?? null;
46
+ }
47
+ /** The block that declares `name` as a fresh collection of `type`, walking up from `from` without leaving the function. */
48
+ function declaringBlock(from, name, type = MAP_TYPE) {
49
+ let current = from.parent;
50
+ while (current) {
51
+ if (FUNCTION_BOUNDARY.test(current.type))
52
+ return null;
53
+ if (current.type === 'block' || current.type === 'constructor_body') {
54
+ for (const statement of named(current)) {
55
+ if (statement.type !== 'local_variable_declaration')
56
+ continue;
57
+ const declarators = named(statement).filter((c) => c.type === 'variable_declarator');
58
+ const mine = declarators.find((d) => d.childForFieldName('name')?.text === name);
59
+ if (!mine)
60
+ continue;
61
+ if (declarators.length !== 1)
62
+ return null;
63
+ const value = mine.childForFieldName('value');
64
+ if (value?.type !== 'object_creation_expression')
65
+ return null;
66
+ const typeText = (value.childForFieldName('type')?.text ?? '').replace(/\s+/g, '');
67
+ if (!type.test(typeText) || !isJavaUtil(typeText, current))
68
+ return null;
69
+ if (named(value.childForFieldName('arguments')).length !== 0)
70
+ return null;
71
+ if (value.childForFieldName('body') ?? named(value).some((c) => c.type === 'class_body'))
72
+ return null;
73
+ return { block: current, declaration: statement };
74
+ }
75
+ }
76
+ current = current.parent;
77
+ }
78
+ return null;
79
+ }
80
+ /*
81
+ * `new HashMap<>()` is java.util's HashMap only when nothing closer has that
82
+ * name: a class in this file called HashMap - whose get() can return
83
+ * anything (tests/probes/j07) - or one in the same package, which outranks
84
+ * `import java.util.*`. So an unqualified name counts only with a
85
+ * single-type `import java.util.HashMap;` and no type of that name declared
86
+ * in the file. `new java.util.HashMap<>()` - BenchmarkJava's spelling - is
87
+ * exact as written.
88
+ */
89
+ function isJavaUtil(typeText, inside) {
90
+ if (typeText.startsWith('java.util.'))
91
+ return true;
92
+ const simple = typeText.replace(/<[\s\S]*$/, '');
93
+ let root = inside;
94
+ while (root.parent)
95
+ root = root.parent;
96
+ const imported = named(root).some((c) => c.type === 'import_declaration' && (c.text ?? '').replace(/\s+/g, '') === `importjava.util.${simple};`);
97
+ if (!imported)
98
+ return false;
99
+ const declared = root.descendantsOfType([
100
+ 'class_declaration', 'interface_declaration', 'enum_declaration', 'record_declaration',
101
+ ]);
102
+ return !declared.some((d) => d?.childForFieldName('name')?.text === simple);
103
+ }
104
+ /** The method or constructor a node sits in - the whole region any mention of the map could hide in. */
105
+ function outermostFunction(from) {
106
+ let current = from.parent;
107
+ let found = null;
108
+ while (current) {
109
+ if (current.type === 'method_declaration' || current.type === 'constructor_declaration')
110
+ found = current;
111
+ if (current.type === 'class_body' && found)
112
+ break;
113
+ current = current.parent;
114
+ }
115
+ return found;
116
+ }
117
+ /**
118
+ * The put a `map.get("key")` certainly returns, or null whenever that is not a
119
+ * fact. Null always means "use the old whole-collection answer", never "clean".
120
+ */
121
+ export function resolveMapRead(call, language) {
122
+ if (language !== 'java' || call.type !== 'method_invocation')
123
+ return null;
124
+ if (call.childForFieldName('name')?.text !== 'get')
125
+ return null;
126
+ const receiver = call.childForFieldName('object');
127
+ if (receiver?.type !== 'identifier')
128
+ return null;
129
+ const mapName = receiver.text;
130
+ const key = literalKey(named(call.childForFieldName('arguments')), 0);
131
+ if (key === null || named(call.childForFieldName('arguments')).length !== 1)
132
+ return null;
133
+ const home = declaringBlock(call, mapName);
134
+ if (!home)
135
+ return null;
136
+ if (home.declaration.endIndex > call.startIndex)
137
+ return null;
138
+ const fn = outermostFunction(call);
139
+ if (!fn)
140
+ return null;
141
+ // Every mention of the name, anywhere in the method - lambdas and inner
142
+ // classes included, since that is exactly where an unseen write would hide.
143
+ const puts = [];
144
+ let escapes = false;
145
+ let walked = 0;
146
+ const visit = (n) => {
147
+ if (escapes)
148
+ return;
149
+ if (++walked > 20000) {
150
+ escapes = true;
151
+ return;
152
+ }
153
+ if (n.type === 'identifier' && n.text === mapName) {
154
+ const parent = n.parent;
155
+ if (parent?.type === 'variable_declarator' && sameSpan(parent.childForFieldName('name'), n)) {
156
+ if (!sameSpan(parent.parent, home.declaration))
157
+ escapes = true; // a second variable of that name
158
+ return;
159
+ }
160
+ if (parent?.type !== 'method_invocation' || !sameSpan(parent.childForFieldName('object'), n)) {
161
+ escapes = true; // passed, returned, assigned, captured, iterated
162
+ return;
163
+ }
164
+ const method = parent.childForFieldName('name')?.text ?? '';
165
+ if (READ_ONLY.has(method))
166
+ return;
167
+ if (method !== 'put') {
168
+ escapes = true;
169
+ return;
170
+ }
171
+ const args = named(parent.childForFieldName('arguments'));
172
+ const putKey = literalKey(args, 0);
173
+ const statement = parent.parent;
174
+ const certain = statement?.type === 'expression_statement' && sameSpan(statement.parent, home.block);
175
+ if (putKey === null || args.length !== 2 || !certain || !args[1]) {
176
+ escapes = true;
177
+ return;
178
+ }
179
+ puts.push({ put: parent, key: putKey, value: args[1] });
180
+ return;
181
+ }
182
+ for (const child of named(n))
183
+ visit(child);
184
+ };
185
+ visit(fn);
186
+ if (escapes)
187
+ return null;
188
+ const before = puts.filter((p) => p.key === key && p.put.endIndex <= call.startIndex);
189
+ const last = before[before.length - 1];
190
+ return last ? { mapName, key, put: last.put, value: last.value } : null;
191
+ }
192
+ /** Assignment-like writes to `name` strictly between two source offsets - any, in any form. */
193
+ export function writtenBetween(fn, name, from, to) {
194
+ let found = false;
195
+ const word = new RegExp(`(^|[^\\w$])${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w$])`);
196
+ const visit = (n) => {
197
+ if (found || n.endIndex <= from || n.startIndex >= to)
198
+ return;
199
+ if (n.type === 'assignment_expression' || n.type === 'update_expression') {
200
+ const target = n.childForFieldName('left') ?? n;
201
+ if (word.test(target.text))
202
+ found = true;
203
+ }
204
+ else if (n.type === 'variable_declarator' && n.childForFieldName('name')?.text === name) {
205
+ found = true;
206
+ }
207
+ for (const child of named(n))
208
+ visit(child);
209
+ };
210
+ visit(fn);
211
+ return found;
212
+ }
213
+ /** The method or constructor containing a node, for callers that need to scan it. */
214
+ export function enclosingMethod(from) {
215
+ return outermostFunction(from);
216
+ }
217
+ /*
218
+ * A value the map holds BY REFERENCE can change after the put without any
219
+ * write to the name the tracer watches: `StringBuilder sb; map.put("k", sb);
220
+ * alias.append(dirty)` - or an array element, or a list. Reading such a name
221
+ * at the `get` would describe the tracer's idea of it, which misses aliases.
222
+ * So a put value is read at the get only when its declared type is one whose
223
+ * values cannot change: String, the primitives and their boxes.
224
+ */
225
+ const IMMUTABLE_TYPES = /^(?:(?:java\.lang\.)?(?:String|Integer|Long|Short|Byte|Character|Boolean|Double|Float)|int|long|short|byte|char|boolean|double|float)$/;
226
+ /** Whether `name`, as declared in `fn`, holds a value that can never change in place. */
227
+ export function declaredImmutable(fn, name) {
228
+ let verdict = null;
229
+ const visit = (n) => {
230
+ if (verdict === false)
231
+ return;
232
+ if (n.type === 'formal_parameter' && n.childForFieldName('name')?.text === name) {
233
+ const ok = IMMUTABLE_TYPES.test((n.childForFieldName('type')?.text ?? '').replace(/\s+/g, ''));
234
+ verdict = verdict === null ? ok : verdict && ok;
235
+ }
236
+ else if (n.type === 'local_variable_declaration') {
237
+ for (const d of named(n)) {
238
+ if (d.type === 'variable_declarator' && d.childForFieldName('name')?.text === name) {
239
+ const ok = IMMUTABLE_TYPES.test((n.childForFieldName('type')?.text ?? '').replace(/\s+/g, ''));
240
+ verdict = verdict === null ? ok : verdict && ok;
241
+ }
242
+ }
243
+ }
244
+ for (const child of named(n))
245
+ visit(child);
246
+ };
247
+ visit(fn);
248
+ return verdict === true;
249
+ }
250
+ /*
251
+ * THE SAME PROOF FOR A LIST, WHERE THE KEY IS A POSITION.
252
+ *
253
+ * List<String> valuesList = new ArrayList<String>();
254
+ * valuesList.add("safe");
255
+ * valuesList.add(param);
256
+ * valuesList.add("moresafe");
257
+ * valuesList.remove(0);
258
+ * bar = valuesList.get(1); // "moresafe"
259
+ *
260
+ * 323 BenchmarkJava cases are this list. Positions move - `remove(0)` shifts
261
+ * everything after it down one - so the list is REPLAYED: every operation that
262
+ * certainly runs before the read, in order, on a model of the list. The same
263
+ * conditions as the map, and a few of a list's own:
264
+ *
265
+ * - a local `new ArrayList<>()` or `new LinkedList<>()`, no arguments;
266
+ * - its only writes are `list.add(value);` (append) and `list.remove(n);`
267
+ * with an integer literal, each its own statement directly in the declaring
268
+ * block. `remove("x")` removes by VALUE and `add(i, v)` inserts - neither is
269
+ * modelled, and either one ends the proof;
270
+ * - reads are `get`, `size`, `isEmpty`, `contains`, `indexOf`, `lastIndexOf`;
271
+ * - the read's index is an integer literal, and every position the replay
272
+ * touches exists. An index out of range throws at runtime, and a proof that
273
+ * has to assume which exception happens is not one.
274
+ */
275
+ const LIST_TYPE = /^(?:java\.util\.)?(?:ArrayList|LinkedList)\s*(?:<[^>]*>)?$/;
276
+ const LIST_READ_ONLY = new Set(['get', 'size', 'isEmpty', 'contains', 'indexOf', 'lastIndexOf']);
277
+ /** An integer literal's value, or null. */
278
+ function intLiteral(n) {
279
+ if (!n || n.type !== 'decimal_integer_literal' || !/^\d+$/.test(n.text))
280
+ return null;
281
+ const value = Number(n.text);
282
+ return Number.isSafeInteger(value) ? value : null;
283
+ }
284
+ /** The element a `list.get(n)` certainly returns, or null whenever that is not a fact. */
285
+ export function resolveListRead(call, language) {
286
+ if (language !== 'java' || call.type !== 'method_invocation')
287
+ return null;
288
+ if (call.childForFieldName('name')?.text !== 'get')
289
+ return null;
290
+ const receiver = call.childForFieldName('object');
291
+ if (receiver?.type !== 'identifier')
292
+ return null;
293
+ const listName = receiver.text;
294
+ const readArgs = named(call.childForFieldName('arguments'));
295
+ const index = readArgs.length === 1 ? intLiteral(readArgs[0]) : null;
296
+ if (index === null)
297
+ return null;
298
+ const home = declaringBlock(call, listName, LIST_TYPE);
299
+ if (!home)
300
+ return null;
301
+ if (home.declaration.endIndex > call.startIndex)
302
+ return null;
303
+ const fn = outermostFunction(call);
304
+ if (!fn)
305
+ return null;
306
+ const ops = [];
307
+ let escapes = false;
308
+ let walked = 0;
309
+ const visit = (n) => {
310
+ if (escapes)
311
+ return;
312
+ if (++walked > 20000) {
313
+ escapes = true;
314
+ return;
315
+ }
316
+ if (n.type === 'identifier' && n.text === listName) {
317
+ const parent = n.parent;
318
+ if (parent?.type === 'variable_declarator' && sameSpan(parent.childForFieldName('name'), n)) {
319
+ if (!sameSpan(parent.parent, home.declaration))
320
+ escapes = true;
321
+ return;
322
+ }
323
+ if (parent?.type !== 'method_invocation' || !sameSpan(parent.childForFieldName('object'), n)) {
324
+ escapes = true;
325
+ return;
326
+ }
327
+ const method = parent.childForFieldName('name')?.text ?? '';
328
+ if (LIST_READ_ONLY.has(method))
329
+ return;
330
+ const args = named(parent.childForFieldName('arguments'));
331
+ const statement = parent.parent;
332
+ const certain = statement?.type === 'expression_statement' && sameSpan(statement.parent, home.block);
333
+ if (!certain) {
334
+ escapes = true;
335
+ return;
336
+ }
337
+ if (method === 'add' && args.length === 1 && args[0]) {
338
+ ops.push({ kind: 'add', node: parent, value: args[0] });
339
+ return;
340
+ }
341
+ const at = method === 'remove' && args.length === 1 ? intLiteral(args[0]) : null;
342
+ if (at !== null) {
343
+ ops.push({ kind: 'remove', node: parent, at });
344
+ return;
345
+ }
346
+ escapes = true;
347
+ return;
348
+ }
349
+ for (const child of named(n))
350
+ visit(child);
351
+ };
352
+ visit(fn);
353
+ if (escapes)
354
+ return null;
355
+ const model = [];
356
+ for (const op of ops.sort((a, b) => a.node.startIndex - b.node.startIndex)) {
357
+ if (op.node.endIndex > call.startIndex)
358
+ break;
359
+ if (op.kind === 'add') {
360
+ model.push({ node: op.node, value: op.value });
361
+ }
362
+ else {
363
+ if (op.at >= model.length)
364
+ return null;
365
+ model.splice(op.at, 1);
366
+ }
367
+ }
368
+ const element = model[index];
369
+ return element ? { listName, index, add: element.node, value: element.value } : null;
370
+ }
371
+ /*
372
+ * THE SAME REPLAY FOR A PYTHON LIST, READ AS `lst[n]`.
373
+ *
374
+ * lst = []
375
+ * lst.append('safe'); lst.append(param); lst.append('moresafe')
376
+ * lst.pop(0)
377
+ * bar = lst[1] # 'moresafe'
378
+ *
379
+ * BenchmarkPython's copy of the Java list above; the engine "proved" it
380
+ * vulnerable four times. Same conditions, in Python's words: `lst = []` as its
381
+ * own statement, the name bound nowhere else in the function, every other
382
+ * mention an `append(v)` / `pop(n)` statement directly in that block or a
383
+ * read `lst[n]`. Anything else - passed, iterated, aliased, sliced, `del`,
384
+ * `global`, a nested function - ends the proof. The caller only accepts a
385
+ * literal element, so nothing stored can change in place afterwards.
386
+ */
387
+ export function resolvePythonListRead(read) {
388
+ if (read.type !== 'subscript')
389
+ return null;
390
+ const receiver = read.childForFieldName('value');
391
+ const indexNode = read.childForFieldName('subscript');
392
+ if (receiver?.type !== 'identifier' || indexNode?.type !== 'integer' || !/^\d+$/.test(indexNode.text))
393
+ return null;
394
+ const listName = receiver.text;
395
+ const index = Number(indexNode.text);
396
+ const fn = enclosingPythonFunction(read);
397
+ if (!fn)
398
+ return null;
399
+ let block = null;
400
+ let declaration = null;
401
+ const ops = [];
402
+ const statements = [];
403
+ let escapes = false;
404
+ let walked = 0;
405
+ const visit = (n) => {
406
+ if (escapes)
407
+ return;
408
+ if (++walked > 20000) {
409
+ escapes = true;
410
+ return;
411
+ }
412
+ if (n.type === 'identifier' && n.text === listName) {
413
+ const parent = n.parent;
414
+ const statement = parent?.parent;
415
+ // lst = [] - the one binding.
416
+ if (parent?.type === 'assignment' && sameSpan(parent.childForFieldName('left'), n)) {
417
+ const right = parent.childForFieldName('right');
418
+ if (block || right?.type !== 'list' || named(right).length > 0 || statement?.type !== 'expression_statement' || statement.parent?.type !== 'block') {
419
+ escapes = true;
420
+ return;
421
+ }
422
+ block = statement.parent;
423
+ declaration = statement;
424
+ statements.push(statement);
425
+ return;
426
+ }
427
+ // lst[n] - a read, unless something writes or deletes through it.
428
+ if (parent?.type === 'subscript' && sameSpan(parent.childForFieldName('value'), n)) {
429
+ const holder = parent.parent;
430
+ const written = (holder?.type === 'assignment' || holder?.type === 'augmented_assignment') && sameSpan(holder.childForFieldName('left'), parent);
431
+ if (written || holder?.type === 'delete_statement' || parent.childForFieldName('subscript')?.type !== 'integer')
432
+ escapes = true;
433
+ return;
434
+ }
435
+ // lst.append(v) / lst.pop(n) as their own statements.
436
+ const call = parent?.parent;
437
+ if (parent?.type === 'attribute' && sameSpan(parent.childForFieldName('object'), n) && call?.type === 'call' && call.parent?.type === 'expression_statement') {
438
+ const method = parent.childForFieldName('attribute')?.text;
439
+ const args = named(call.childForFieldName('arguments'));
440
+ statements.push(call.parent);
441
+ if (method === 'append' && args.length === 1 && args[0]) {
442
+ ops.push({ kind: 'add', node: call, value: args[0] });
443
+ return;
444
+ }
445
+ if (method === 'pop' && args.length === 1 && args[0]?.type === 'integer' && /^\d+$/.test(args[0].text)) {
446
+ ops.push({ kind: 'remove', node: call, at: Number(args[0].text) });
447
+ return;
448
+ }
449
+ }
450
+ escapes = true;
451
+ return;
452
+ }
453
+ for (const child of named(n))
454
+ visit(child);
455
+ };
456
+ visit(fn);
457
+ // Every write certainly runs: each is a statement directly in the declaring block.
458
+ if (escapes || !block || !declaration || statements.some((s) => !sameSpan(s.parent, block)))
459
+ return null;
460
+ const home = declaration;
461
+ if (home.endIndex > read.startIndex || !contains(block, read))
462
+ return null;
463
+ const model = [];
464
+ for (const op of ops.sort((a, b) => a.node.startIndex - b.node.startIndex)) {
465
+ if (op.node.endIndex > read.startIndex)
466
+ break;
467
+ if (op.node.startIndex < home.startIndex)
468
+ return null;
469
+ if (op.kind === 'add')
470
+ model.push({ node: op.node, value: op.value });
471
+ else {
472
+ if (op.at >= model.length)
473
+ return null;
474
+ model.splice(op.at, 1);
475
+ }
476
+ }
477
+ const element = model[index];
478
+ return element ? { listName, index, add: element.node, value: element.value } : null;
479
+ }
480
+ const contains = (outer, inner) => outer.startIndex <= inner.startIndex && outer.endIndex >= inner.endIndex;
481
+ /** The Python function a node sits in, or null at module level. */
482
+ export function enclosingPythonFunction(from) {
483
+ let fn = from.parent;
484
+ while (fn && fn.type !== 'function_definition')
485
+ fn = fn.parent;
486
+ return fn;
487
+ }
488
+ /** Whether any identifier spelled `name` appears in `fn` strictly between two offsets. */
489
+ export function mentionedBetween(fn, name, from, to) {
490
+ let found = false;
491
+ const visit = (n) => {
492
+ if (found || n.endIndex <= from || n.startIndex >= to)
493
+ return;
494
+ if (n.type === 'identifier' && n.text === name)
495
+ found = true;
496
+ for (const child of named(n))
497
+ visit(child);
498
+ };
499
+ visit(fn);
500
+ return found;
501
+ }
502
+ /*
503
+ * THE SAME PROOF FOR A PYTHON DICT, READ AS `d['k']`.
504
+ *
505
+ * m = {}
506
+ * m['keyA'] = 'a-Value'
507
+ * m['keyB'] = param
508
+ * m['keyC'] = 'another-Value'
509
+ * bar = m['keyB'] # param
510
+ *
511
+ * BenchmarkPython's copy of the Java HashMap above. Conditions, as for the
512
+ * list: `m = {}` once, as its own statement; every other mention of the name
513
+ * is either a write `m['literal'] = v` as its own statement directly in that
514
+ * block, or a read `m['literal']`. Anything else - passed whole (`.format(m)`),
515
+ * a method (`m.get`, `m.update`), iterated, `del`, `global`, a key that is not
516
+ * a plain literal - ends the proof. Two literals are the same key exactly when
517
+ * their text matches: no prefixes, no escapes.
518
+ */
519
+ const PY_KEY = /^(['"])([^'"\\]*)\1$/;
520
+ const pyKey = (n) => (n?.type === 'string' ? PY_KEY.exec(n.text)?.[2] ?? null : null);
521
+ export function resolvePythonDictRead(read) {
522
+ if (read.type !== 'subscript')
523
+ return null;
524
+ const receiver = read.childForFieldName('value');
525
+ const key = pyKey(read.childForFieldName('subscript'));
526
+ if (receiver?.type !== 'identifier' || key === null)
527
+ return null;
528
+ const name = receiver.text;
529
+ const fn = enclosingPythonFunction(read);
530
+ if (!fn)
531
+ return null;
532
+ let declaration = null;
533
+ const writes = [];
534
+ let escapes = false;
535
+ let walked = 0;
536
+ const visit = (n) => {
537
+ if (escapes)
538
+ return;
539
+ if (++walked > 20000) {
540
+ escapes = true;
541
+ return;
542
+ }
543
+ if (n.type === 'identifier' && n.text === name) {
544
+ const parent = n.parent;
545
+ const statement = parent?.parent;
546
+ // m = {} - the one binding.
547
+ if (parent?.type === 'assignment' && sameSpan(parent.childForFieldName('left'), n)) {
548
+ const right = parent.childForFieldName('right');
549
+ if (declaration || right?.type !== 'dictionary' || named(right).length > 0 || statement?.type !== 'expression_statement' || statement.parent?.type !== 'block') {
550
+ escapes = true;
551
+ return;
552
+ }
553
+ declaration = statement;
554
+ return;
555
+ }
556
+ if (parent?.type === 'subscript' && sameSpan(parent.childForFieldName('value'), n)) {
557
+ const k = pyKey(parent.childForFieldName('subscript'));
558
+ const holder = parent.parent;
559
+ const value = holder?.childForFieldName('right');
560
+ if (k === null)
561
+ escapes = true;
562
+ else if (holder?.type === 'assignment' && sameSpan(holder.childForFieldName('left'), parent)) {
563
+ if (!value || holder.parent?.type !== 'expression_statement')
564
+ escapes = true;
565
+ else
566
+ writes.push({ key: k, node: holder.parent, value });
567
+ }
568
+ else if (holder?.type === 'augmented_assignment' || holder?.type === 'delete_statement')
569
+ escapes = true;
570
+ return;
571
+ }
572
+ escapes = true;
573
+ return;
574
+ }
575
+ for (const child of named(n))
576
+ visit(child);
577
+ };
578
+ visit(fn);
579
+ const home = declaration; // assigned inside visit(), which TS cannot see
580
+ const block = home?.parent ?? null;
581
+ // Every write certainly runs: each is a statement directly in the declaring block.
582
+ if (escapes || !home || !block || writes.some((w) => !sameSpan(w.node.parent, block) || w.node.startIndex < home.startIndex))
583
+ return null;
584
+ if (home.endIndex > read.startIndex || !contains(block, read))
585
+ return null;
586
+ const last = writes.filter((w) => w.key === key && w.node.endIndex <= read.startIndex).pop();
587
+ return last ? { container: name, selector: `'${key}'`, write: last.node, value: last.value } : null;
588
+ }
589
+ /** Try the map proof, then the list proof. Null means "use the whole-collection answer". */
590
+ export function resolveContainerRead(call, language) {
591
+ if (language === 'python') {
592
+ const list = resolvePythonListRead(call);
593
+ return list ? { container: list.listName, selector: `index ${list.index}`, write: list.add, value: list.value } : resolvePythonDictRead(call);
594
+ }
595
+ const map = resolveMapRead(call, language);
596
+ if (map)
597
+ return { container: map.mapName, selector: `"${map.key}"`, write: map.put, value: map.value };
598
+ const list = resolveListRead(call, language);
599
+ if (list)
600
+ return { container: list.listName, selector: `index ${list.index}`, write: list.add, value: list.value };
601
+ return null;
602
+ }
603
+ //# sourceMappingURL=local-map.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"local-map.js","sourceRoot":"","sources":["../../../src/taint/local-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAcH,MAAM,QAAQ,GAAG,6DAA6D,CAAC;AAC/E,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACtF,MAAM,iBAAiB,GAAG,+EAA+E,CAAC;AAE1G,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAU,EAAE,CACnD,CAAC,CAAC,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAEhE,MAAM,QAAQ,GAAG,CAAC,CAA0B,EAAE,CAA0B,EAAW,EAAE,CACnF,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC;AAE3E,uDAAuD;AACvD,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,2HAA2H;AAC3H,SAAS,cAAc,CAAC,IAAU,EAAE,IAAY,EAAE,OAAe,QAAQ;IACvE,IAAI,OAAO,GAAgB,IAAI,CAAC,MAAM,CAAC;IACvC,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACpE,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,IAAI,SAAS,CAAC,IAAI,KAAK,4BAA4B;oBAAE,SAAS;gBAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;gBACrF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC;gBACjF,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAC9C,IAAI,KAAK,EAAE,IAAI,KAAK,4BAA4B;oBAAE,OAAO,IAAI,CAAC;gBAC9D,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACnF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACxE,IAAI,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC1E,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACtG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,QAAgB,EAAE,MAAY;IAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,GAAS,MAAM,CAAC;IACxB,OAAO,IAAI,CAAC,MAAM;QAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,mBAAmB,MAAM,GAAG,CAC9G,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,mBAAmB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,oBAAoB;KACvF,CAAC,CAAC;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,wGAAwG;AACxG,SAAS,iBAAiB,CAAC,IAAU;IACnC,IAAI,OAAO,GAAgB,IAAI,CAAC,MAAM,CAAC;IACvC,IAAI,KAAK,GAAgB,IAAI,CAAC;IAC9B,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB;YAAE,KAAK,GAAG,OAAO,CAAC;QACzG,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK;YAAE,MAAM;QAClD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAU,EAAE,QAAoB;IAC7D,IAAI,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzF,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAErB,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,IAAI,GAAmD,EAAE,CAAC;IAChE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,CAAO,EAAQ,EAAE;QAC9B,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,IAAI,MAAM,EAAE,IAAI,KAAK,qBAAqB,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;oBAAE,OAAO,GAAG,IAAI,CAAC,CAAC,iCAAiC;gBACjG,OAAO;YACT,CAAC;YACD,IAAI,MAAM,EAAE,IAAI,KAAK,mBAAmB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC7F,OAAO,GAAG,IAAI,CAAC,CAAC,iDAAiD;gBACjE,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YAC5D,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO;YAClC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAChC,MAAM,OAAO,GACX,SAAS,EAAE,IAAI,KAAK,sBAAsB,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACvF,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAAC,EAAQ,EAAE,IAAY,EAAE,IAAY,EAAE,EAAU;IAC7E,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,CAAC,CAAO,EAAQ,EAAE;QAC9B,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;YAAE,OAAO;QAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzE,MAAM,MAAM,GAAG,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC;QAC3C,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1F,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,wIAAwI,CAAC;AAEjK,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,EAAQ,EAAE,IAAY;IACtD,IAAI,OAAO,GAAmB,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAO,EAAQ,EAAE;QAC9B,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;YAChF,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YAC/F,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QAClD,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,4BAA4B,EAAE,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnF,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;oBAC/F,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,SAAS,GAAG,4DAA4D,CAAC;AAC/E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;AAEjG,2CAA2C;AAC3C,SAAS,UAAU,CAAC,CAAmB;IACrC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,yBAAyB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAUD,0FAA0F;AAC1F,MAAM,UAAU,eAAe,CAAC,IAAU,EAAE,QAAoB;IAC9D,IAAI,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAGrB,MAAM,GAAG,GAAS,EAAE,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,CAAO,EAAQ,EAAE;QAC9B,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,IAAI,MAAM,EAAE,IAAI,KAAK,qBAAqB,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;oBAAE,OAAO,GAAG,IAAI,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,MAAM,EAAE,IAAI,KAAK,mBAAmB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC7F,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YAC5D,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAChC,MAAM,OAAO,GACX,SAAS,EAAE,IAAI,KAAK,sBAAsB,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACvF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjF,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3E,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;YAAE,MAAM;QAC9C,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,IAAI,EAAE,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACvC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,QAAQ,EAAE,IAAI,KAAK,YAAY,IAAI,SAAS,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnH,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAErB,IAAI,KAAK,GAAgB,IAAI,CAAC;IAC9B,IAAI,WAAW,GAAgB,IAAI,CAAC;IAEpC,MAAM,GAAG,GAAS,EAAE,CAAC;IACrB,MAAM,UAAU,GAAW,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,CAAO,EAAQ,EAAE;QAC9B,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,EAAE,MAAM,CAAC;YACjC,+BAA+B;YAC/B,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACnF,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,KAAK,IAAI,KAAK,EAAE,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,IAAI,KAAK,sBAAsB,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;oBACnJ,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC;gBACzB,WAAW,GAAG,SAAS,CAAC;gBACxB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,kEAAkE;YAClE,IAAI,MAAM,EAAE,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACnF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,MAAM,OAAO,GACX,CAAC,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,MAAM,EAAE,IAAI,KAAK,sBAAsB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;gBACnI,IAAI,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,IAAI,KAAK,SAAS;oBAAE,OAAO,GAAG,IAAI,CAAC;gBAChI,OAAO;YACT,CAAC;YACD,sDAAsD;YACtD,MAAM,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC;YAC5B,IAAI,MAAM,EAAE,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBAC7J,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;gBAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;gBACxD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACnE,OAAO;gBACT,CAAC;YACH,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,mFAAmF;IACnF,IAAI,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzG,MAAM,IAAI,GAAS,WAAW,CAAC;IAC/B,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3E,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3E,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;YAAE,MAAM;QAC9C,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;aACjE,CAAC;YACJ,IAAI,EAAE,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACvC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAW,EAAE,KAAW,EAAW,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;AAEjI,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CAAC,IAAU;IAChD,IAAI,EAAE,GAAgB,IAAI,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,qBAAqB;QAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;IAC/D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,EAAQ,EAAE,IAAY,EAAE,IAAY,EAAE,EAAU;IAC/E,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,KAAK,GAAG,CAAC,CAAO,EAAQ,EAAE;QAC9B,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;YAAE,OAAO;QAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,KAAK,GAAG,IAAI,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE9H,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,IAAI,QAAQ,EAAE,IAAI,KAAK,YAAY,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAErB,IAAI,WAAW,GAAgB,IAAI,CAAC;IACpC,MAAM,MAAM,GAAoD,EAAE,CAAC;IACnE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,CAAO,EAAQ,EAAE;QAC9B,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,EAAE,MAAM,CAAC;YACjC,6BAA6B;YAC7B,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACnF,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,IAAI,KAAK,sBAAsB,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC/J,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,WAAW,GAAG,SAAS,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,EAAE,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACnF,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;gBACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC;qBAC1B,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;oBAC7F,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,sBAAsB;wBAAE,OAAO,GAAG,IAAI,CAAC;;wBACxE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3D,CAAC;qBAAM,IAAI,MAAM,EAAE,IAAI,KAAK,sBAAsB,IAAI,MAAM,EAAE,IAAI,KAAK,kBAAkB;oBAAE,OAAO,GAAG,IAAI,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,MAAM,IAAI,GAAG,WAA0B,CAAC,CAAC,+CAA+C;IACxF,MAAM,KAAK,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;IACnC,mFAAmF;IACnF,IAAI,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1I,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7F,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtG,CAAC;AAYD,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,IAAU,EAAE,QAAoB;IACnE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAChJ,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,GAAG;QAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IACvG,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC"}