\n
\n\n\n\n\n\n\n\n\n"
},
{
"path": "js/ascene.js",
"content": "// Copyright 2017 Google Inc.\n//\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n// http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\nlet aframeContent = `\n\n ![\"headphone](\"static/img/Headphone.png\")
\n Headphones Recommended\n
\n \n Headphones Recommended\n \n
\n LOADING![](\"static/img/loader.gif\")
\n \n
\n No VR? Take a peek in 360 mode
\n \n
\n \n \n ![\"WebVR](\"static/img/webVR_experiment@3x.png\")
\n
\n \n \n \n ![\"Friends](\"static/img/friends_with_g@3x.png\")
\n
\n \n \n
\n \n\n ![\"about\"](\"static/img/aboutbg.gif\")
\n \n
\n The Musical Forest
\n\n
\n \n Join users from around the world in a musical forest. Tap or click a shape to play it. If you're using a headset like the HTC VIVE, you can add shapes too. This experiment demonstrates cross-device co-presence in VR, allowing anyone to join in, no matter what device they're using.\n
\n\n Technologies used: AFrame, Three.js, Tone.js, Node.js, PubSub\n
\n\n Made by Google Creative Lab. Check out other WebVR Experiments here and check out the open-source code on GitHub.\n
\n\n \n ![](\"/static/img/ball_circles_134.png\")
\n ![](\"/static/img/ball_circles_567.png\")
\n ![](\"/static/img/ball_triangles_134.png\")
\n ![](\"/static/img/ball_triangles_567.png\")
\n ![](\"/static/img/ball_squares_134.png\")
\n ![](\"/static/img/ball_squares_567.png\")
\n ![](\"/static/img/mobile-trees.png\")
\n\n ';\n container.appendChild(p);\n\n let p2 = document.createElement(\"p\");\n p2.innerHTML = 'No Cardboard viewer?';\n container.appendChild(p2);\n\n let b = document.createElement(\"button\");\n b.innerHTML = `GET ONE`;\n container.appendChild(b);\n\n b.addEventListener(\"click\", () => {\n window.open(\"https://vr.google.com/cardboard/get-cardboard/\", '_blank');\n });\n }\n },\n isTabletLikeDimensions() {\n let w = screen.availWidth;\n let h = screen.availHeight;\n return ( ( (w > h) ? w : h ) >= 960 );\n },\n isTouchDevice() {\n return 'ontouchstart' in window || navigator.maxTouchPoints; // works on most browsers || works on IE10/11 and Surface\n },\n});\n\nfunction tweenUpdate() {\n requestAnimationFrame(tweenUpdate);\n TWEEN.update();\n}\ntweenUpdate();\n\n\n(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){\n (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),\n m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)\n})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');\n\nga('create', 'UA-90331006-2', 'auto');\nga('send', 'pageview');\n\nlet aboutBTN = document.getElementById('about-button');\nlet about = document.getElementById('about');\n\naboutBTN.addEventListener('click', () => {\n about.classList.add('visible');\n aboutBTN.classList.remove('visible');\n ga('send', 'event', 'clickable_link', 'splash_page', 'show_info');\n});\n\nabout.addEventListener('click', () => {\n about.classList.remove('visible');\n aboutBTN.classList.add('visible');\n});\n" }, { "path": "js/util/browserCheck.js", "content": "// Copyright 2017 Google Inc.\n//\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n// http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\nimport { showErrorMessage } from '../util';\n\n\nif(navigator.userAgent.indexOf('MSIE')!==-1 || navigator.appVersion.indexOf('Trident/') > 0) {\n showErrorMessage(\"error_shake.gif\", \"Your browser is not supported\",\"Download Chrome\",\"http://www.google.com/chrome\");\n}\n" }, { "path": "js/util/random-range-1d.js", "content": "// Copyright 2017 Google Inc.\n//\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n// http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\nexport class RandomRange {\n\n\tconstructor( min, max ) {\n\t\tthis.min = min;\n\t\tthis.max = max;\n\t}\n\n\tget [ 'value' ]() { \n\t\treturn Math.random() * ( this.max - this.min ) + this.min;\n\t}\n}" }, { "path": "js/util/random-range-3d.js", "content": "// Copyright 2017 Google Inc.\n//\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n// http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\nimport { RandomRange } from './random-range-1d';\n\nexport class RandomRange3D {\n\n\tconstructor( min, max ) {\n\t\tthis.type = min.constructor;\n\t\tthis.range3D = {\n\t\t\tx: new RandomRange( min.x, max.x ),\n\t\t\ty: new RandomRange( min.y, max.y ),\n\t\t\tz: new RandomRange( min.z, max.z )\n\t\t};\n\t}\n\n\tget x() { return this.range3D.x.value; }\n\tget y() { return this.range3D.y.value; }\n\tget z() { return this.range3D.z.value; }\n\t\n\tget [ 'value' ]() { \n\t\treturn new this.type( this.x, this.y, this.z );\n\t}\n}" }, { "path": "js/util/tetrahedron.js", "content": "// Copyright 2017 Google Inc.\n//\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n// http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\nconst X = Math.sqrt( 2 / 3 );\nconst Y = 1 / 3;\nconst Z = 1 / Math.sqrt( 2 ) * ( 2 / 3);\n\nconst v1 = new THREE.Vector3( -X, -Y, Z );\nconst v2 = new THREE.Vector3( +X, -Y, Z );\nconst v3 = new THREE.Vector3( 0, -Y, -Z * 2 );\nconst v4 = new THREE.Vector3( 0, 1, 0 );\n\nconst f1 = new THREE.Face3( 2, 1, 0 );\nconst f2 = new THREE.Face3( 1, 3, 0 );\nconst f3 = new THREE.Face3( 2, 3, 1 );\nconst f4 = new THREE.Face3( 0, 3, 2 );\n\nconst t1 = new THREE.Vector2( 1, 0 );\nconst t2 = new THREE.Vector2( 0.5, 1 );\nconst t3 = new THREE.Vector2( 0, 0 );\n\nconst uvs = [\n\t[ t1, t2, t3 ],\n\t[ t1, t2, t3 ],\n\t[ t1, t2, t3 ],\n\t[ t1, t2, t3 ]\n];\n\nexport class Tetrahedron {\n\n\tconstructor() {\n\t\tthis.geometry = new THREE.Geometry();\n\t\tthis.geometry.vertices.push( v1, v2, v3, v4 );\n\t\tthis.geometry.faces.push( f1, f2, f3, f4 );\n\t\tthis.geometry.faceVertexUvs = [ uvs ];\n\t\tthis.geometry.scale( 0.32, 0.32, 0.32 );\n\n\t\tthis.geometry.uvsNeedUpdate = true;\n\n\t\t// Compute normals automatically\n\t\tthis.geometry.computeFaceNormals();\n\t\tthis.geometry.computeVertexNormals();\n\t}\n}\n" }, { "path": "js/util/trace.js", "content": "// Copyright 2017 Google Inc.\n//\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n// http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\nif (typeof console._commandLineAPI !== 'undefined') {\n console.API = console._commandLineAPI; //chrome\n} else if (typeof console._inspectorCommandLineAPI !== 'undefined') {\n console.API = console._inspectorCommandLineAPI; //Safari\n} else if (typeof console.clear !== 'undefined') {\n console.API = console;\n}\nwindow.clear = console.API.clear;\nwindow.trace = console.log;\n" }, { "path": "js/util.js", "content": "// Copyright 2017 Google Inc.\n//\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n// http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\nexport function getParameterByName(name, url) {\n if (!url) {\n url = window.location.href;\n }\n name = name.replace(/[\\[\\]]/g, \"\\\\$&\");\n let regex = new RegExp(\"[?&]\" + name + \"(=([^&#]*)|&|#|$)\"),\n results = regex.exec(url);\n if (!results) return null;\n if (!results[2]) return '';\n return decodeURIComponent(results[2].replace(/\\+/g, \" \"));\n}\n\nexport function scale(value, inMin, inMax, outMin, outMax) {\n return ((value - inMin) / (inMax - inMin)) * (outMax - outMin) + outMin;\n}\n\nexport function getViewerType(callBack){\n\n navigator.getVRDisplays()\n .then( function( displays ) {\n if(displays.length>0 && displays[0].isPresenting) {\n if (displays[0].stageParameters === null) {\n callBack('3dof');\n } else {\n callBack('6dof');\n }\n } else {\n callBack('viewer');\n }\n })\n .catch( function() {\n callBack('viewer');\n });\n\n}\n\nexport function showErrorMessage(imgURL, errorCode, cta, ctaUrl){\n\n console.error(errorCode);\n let error = document.querySelector(\"#error\");\n\n // delete error if it already exists\n if(error) {\n error.remove();\n }\n\n // createElement\n error = document.createElement('div');\n error.id = 'error';\n document.body.appendChild(error);\n\n let container = document.createElement('div');\n container.id = 'errorContainer';\n error.appendChild(container);\n\n let img = document.createElement(\"img\");\n img.id = \"img\";\n img.src = `/static/img/${imgURL}`;\n container.appendChild(img);\n\n let p = document.createElement(\"p\");\n let notification = `${errorCode}`;\n p.appendChild(document.createTextNode(notification));\n container.appendChild(p);\n\n let b = document.createElement(\"button\");\n b.innerHTML = `${cta}`;\n container.appendChild(b);\n\n b.addEventListener(\"click\", () => {\n if(ctaUrl){\n window.open(ctaUrl, '_blank');\n } else {\n window.location.href = window.location.href.replace(/#.*/,'#');\n error.remove();\n let splash = document.querySelector('#splash');\n splash.classList.remove('invisible');\n }\n });\n}\n\nwindow.showErrorMessage = showErrorMessage;\n" }, { "path": "package.json", "content": "{\n \"name\": \"webvr-musical-forest\",\n \"version\": \"0.0.1\",\n \"description\": \"\",\n \"authors\": [],\n \"scripts\": {\n \"start\": \"npm run build-css && npm run budo\",\n \"build\": \"browserify js/index.js | derequire > build/main.js\",\n \"buildmin\": \"browserify -g uglifyify js/index.js | derequire > build/main.js\",\n \"build-css\": \"node-sass --include-path scss style/splash.scss build/style.css\",\n \"budo\": \"budo js/index.js:build/main.js --live --verbose --port 3000\",\n \"appengine\": \"~/bin/google_appengine/dev_appserver.py app.yaml\",\n \"appengine_watch\": \"parallelshell 'npm run appengine' 'npm run watch'\",\n \"watch\": \"watchify js/index.js -v -d -o build/main.js\",\n \"discify\": \"browserify --full-paths js/index.js | derequire | discify --open\"\n },\n \"repository\": {\n \"type\": \"git\",\n \"url\": \"https://github.com/googlecreativelab/webvr-musicalforest\"\n },\n \"dependencies\": {\n \"aframe\": \"^0.5.0\",\n \"bufferutil\": \"^1.2.1\",\n \"domready\": \"^1.0.8\",\n \"envify\": \"^4.0.0\",\n \"image-promise\": \"^4.0.1\",\n \"startaudiocontext\": \"^1.2.0\",\n \"tone\": \"^0.9.0\",\n \"uglifyify\": \"^3.0.4\",\n \"underscore\": \"^1.8.3\",\n \"url-parse\": \"^1.1.6\",\n \"webvr-polyfill\": \"aframevr/webvr-polyfill\",\n \"webvr-ui\": \"^0.9.4\"\n },\n \"devDependencies\": {\n \"babel-preset-es2015\": \"^6.16.0\",\n \"babel-preset-stage-2\": \"^6.22.0\",\n \"babelify\": \"^7.3.0\",\n \"browserify\": \"^14.0.0\",\n \"budo\": \"^9.4.7\",\n \"derequire\": \"^2.0.3\",\n \"discify\": \"^1.6.0\",\n \"node-sass\": \"^4.5.2\",\n \"parallelshell\": \"^2.0.0\",\n \"utf-8-validate\": \"^1.2.1\",\n \"watchify\": \"^3.7.0\"\n },\n \"keywords\": [\n \"vr\",\n \"webvr\"\n ],\n \"license\": \"Apache-2.0\",\n \"browserify\": {\n \"transform\": [\n [\n \"babelify\",\n {\n \"presets\": [\n \"es2015\"\n ]\n }\n ]\n ]\n }\n}\n" }, { "path": "python/__init__.py", "content": "" }, { "path": "python/base/__init__.py", "content": "" }, { "path": "python/base/api_fixer.py", "content": "# Copyright 2014 Google Inc. All rights reserved.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\"\"\"Fixes up various popular APIs to ensure they use secure defaults.\"\"\"\n\nimport __builtin__\nimport constants\nimport cPickle\nimport functools\nimport io\nimport json\nimport logging\nimport pickle\nimport yaml\n\nfrom google.appengine.api import urlfetch\nfrom webapp2_extras import sessions\n\n\nclass ApiSecurityException(Exception):\n \"\"\"Error when attempting to call an unsafe API.\"\"\"\n pass\n\n\ndef FindArgumentIndex(function, argument):\n args = function.func_code.co_varnames[:function.func_code.co_argcount]\n return args.index(argument)\n\n\ndef GetDefaultArgument(function, argument):\n argument_index = FindArgumentIndex(function, argument)\n num_positional_args = (function.func_code.co_argcount -\n len(function.func_defaults))\n default_position = argument_index - num_positional_args\n if default_position < 0:\n return None\n return function.func_defaults[default_position]\n\n\ndef ReplaceDefaultArgument(function, argument, replacement):\n argument_index = FindArgumentIndex(function, argument)\n num_positional_args = (function.func_code.co_argcount -\n len(function.func_defaults))\n default_position = argument_index - num_positional_args\n if default_position < 0:\n raise ApiSecurityException('Attempt to modify positional default value')\n new_defaults = list(function.func_defaults)\n new_defaults[default_position] = replacement\n function.func_defaults = tuple(new_defaults)\n\n\n# JSON.\n# Does not escape HTML metacharacters by default.\n_JSON_CHARACTER_REPLACEMENT_MAPPING = [\n ('<', '\\\\u%04x' % ord('<')),\n ('>', '\\\\u%04x' % ord('>')),\n ('&', '\\\\u%04x' % ord('&')),\n]\n\n\nclass _JsonEncoderForHtml(json.JSONEncoder):\n\n def encode(self, o):\n chunks = self.iterencode(o, _one_shot=True)\n if not isinstance(chunks, (list, tuple)):\n chunks = list(chunks)\n return ''.join(chunks)\n\n def iterencode(self, o, _one_shot=False):\n chunks = super(_JsonEncoderForHtml, self).iterencode(o, _one_shot)\n for chunk in chunks:\n for (character, replacement) in _JSON_CHARACTER_REPLACEMENT_MAPPING:\n chunk = chunk.replace(character, replacement)\n yield chunk\n\n\nReplaceDefaultArgument(json.dump, 'cls', _JsonEncoderForHtml)\nReplaceDefaultArgument(json.dumps, 'cls', _JsonEncoderForHtml)\n\n\n# Pickle. See http://www.cs.jhu.edu/~s/musings/pickle.html for more info.\n# Whitelist of module name => (module, [list of safe names])\n_PICKLE_CLASS_WHITELIST = { '__builtin__': (__builtin__,\n ['basestring',\n 'bool',\n 'buffer',\n 'bytearray',\n 'bytes',\n 'complex',\n 'dict',\n 'enumerate',\n 'float',\n 'frozenset',\n 'int',\n 'list',\n 'long',\n 'reversed',\n 'set',\n 'slice',\n 'str',\n 'tuple',\n 'unicode',\n 'xrange']),\n }\n\n# See https://docs.python.org/3/library/pickle.html#restricting-globals.\nclass RestrictedUnpickler(pickle.Unpickler):\n\n def find_class(self, module_name, name):\n (module, safe_names) = _PICKLE_CLASS_WHITELIST.get(module_name, (None, []))\n if name in safe_names:\n return getattr(module, name)\n raise ApiSecurityException('%s.%s forbidden in unpickling' % (module, name))\n\ndef _SafePickleLoad(f):\n return RestrictedUnpickler(f).load()\n\ndef _SafePickleLoads(string):\n return RestrictedUnpickler(io.BytesIO(string)).load()\n\npickle.load = _SafePickleLoad\npickle.loads = _SafePickleLoads\ncPickle.load = _SafePickleLoad\ncPickle.loads = _SafePickleLoads\n\n\n# YAML. The Python tag scheme allows arbitrary code execution:\n# yaml.load('!!python/object/apply:os.system [\"ls\"]')\nReplaceDefaultArgument(yaml.compose, 'Loader', yaml.loader.SafeLoader)\nReplaceDefaultArgument(yaml.compose_all, 'Loader', yaml.loader.SafeLoader)\nReplaceDefaultArgument(yaml.load, 'Loader', yaml.loader.SafeLoader)\nReplaceDefaultArgument(yaml.load_all, 'Loader', yaml.loader.SafeLoader)\nReplaceDefaultArgument(yaml.parse, 'Loader', yaml.loader.SafeLoader)\nReplaceDefaultArgument(yaml.scan, 'Loader', yaml.loader.SafeLoader)\n\n\n# AppEngine urlfetch.\n# Does not validate certificates by default.\nReplaceDefaultArgument(urlfetch.fetch, 'validate_certificate', True)\nReplaceDefaultArgument(urlfetch.make_fetch_call, 'validate_certificate', True)\n\n\ndef _HttpUrlLoggingWrapper(func):\n \"\"\"Decorates func, logging when 'url' params do not start with https://.\"\"\"\n @functools.wraps(func)\n def _CheckAndLog(*args, **kwargs):\n try:\n arg_index = FindArgumentIndex(func, 'url')\n except ValueError:\n return func(*args, **kwargs)\n\n if arg_index < len(args):\n arg_value = args[arg_index]\n elif 'url' in kwargs:\n arg_value = kwargs['url']\n elif 'url' not in kwargs:\n arg_value = GetDefaultArgument(func, 'url')\n\n if arg_value and not arg_value.startswith('https://'):\n logging.warn('SECURITY : fetching non-HTTPS url %s' % (arg_value))\n return func(*args, **kwargs)\n return _CheckAndLog\n\nurlfetch.fetch = _HttpUrlLoggingWrapper(urlfetch.fetch)\nurlfetch.make_fetch_call = _HttpUrlLoggingWrapper(urlfetch.make_fetch_call)\n\n# webapp2_extras session does not set HttpOnly/Secure by default.\nsessions.default_config['cookie_args']['secure'] = (not\n constants.IS_DEV_APPSERVER)\nsessions.default_config['cookie_args']['httponly'] = True\n\n" }, { "path": "python/base/api_fixer_test.py", "content": "# Copyright 2014 Google Inc. All rights reserved.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\"\"\"Tests for base.api_fixer.\"\"\"\n\nimport json\nimport pickle\nimport unittest2\nimport yaml\n\nimport api_fixer\n\n\nclass BadPickle(object):\n \"\"\"Dummy object.\"\"\"\n def __reduce__(self):\n return tuple([eval, tuple(['[1][2]'])])\n\n\nclass ApiFixerTest(unittest2.TestCase):\n \"\"\"Test cases for base.api_fixer.\"\"\"\n\n def testJsonEscaping(self):\n o = {'foo': ''}\n self.assertFalse('<' in json.dumps(o))\n\n def testYamlLoading(self):\n unsafe = '!!python/object/apply:os.system [\"ls\"]'\n try:\n yaml.load(unsafe)\n self.fail('loading unsafe YAML object succeeded')\n except yaml.constructor.ConstructorError:\n pass\n\n def testPickle(self):\n b = { 'foo': BadPickle() }\n s = pickle.dumps(b)\n try:\n b = pickle.loads(s)\n self.fail('BadPickle() loaded successfully')\n except IndexError:\n self.fail('pickled code execution')\n except api_fixer.ApiSecurityException:\n pass\n\n foo = { 'bar': [1, 2, 3] }\n s = pickle.dumps(foo)\n try:\n foo = pickle.loads(s)\n self.assertEqual(foo['bar'][0], 1)\n except Exception:\n self.fail('safe unpickling failed')\n\n\nif __name__ == '__main__':\n unittest2.main()\n" }, { "path": "python/base/constants.py", "content": "# Copyright 2014 Google Inc. All rights reserved.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\"\"\"Public constants for use in application configuration.\"\"\"\n\nimport os\n\n\ndef _IsDevAppServer():\n return os.environ.get('SERVER_SOFTWARE', '').startswith('Development')\n\n# CSP Nonce length\nNONCE_LENGTH = 10\n\n# webapp2 application configuration constants.\n# template\n(CLOSURE, DJANGO, JINJA2) = range(0, 3)\n\n# using_angular\nDEFAULT_ANGULAR = False\n\n# framing_policy\n(DENY, SAMEORIGIN, PERMIT) = range(0, 3)\nX_FRAME_OPTIONS_VALUES = {DENY: 'DENY', SAMEORIGIN: 'SAMEORIGIN'}\n\n# hsts_policy\nDEFAULT_HSTS_POLICY = {'max_age': 2592000, 'includeSubdomains': True}\n\n# placeholder for the CSP nonce. 'nonce_value' is replaced for every response\n# in base/handers.py with a random nonce value.\nCSP_NONCE_PLACEHOLDER_FORMAT = '\\'nonce-%(nonce_value)s\\' '\n\n# IS_DEV_APPSERVER is primarily used for decisions that rely on whether or\n# not the application is currently serving over HTTPS (dev_appserver does\n# not support HTTPS).\nIS_DEV_APPSERVER = _IsDevAppServer()\n\nDEBUG = IS_DEV_APPSERVER\n\nTEMPLATE_DIR = os.path.sep.join([os.path.dirname(__file__), '..', '..'])\n\n# csp_policy\nDEFAULT_CSP_POLICY = {\n # Disallow Flash, etc.\n 'object-src': '\\'none\\'',\n # Strict CSP with fallbacks for browsers not supporting CSP v3.\n 'script-src': CSP_NONCE_PLACEHOLDER_FORMAT +\n # Propagate trust to dynamically created scripts.\n '\\'strict-dynamic\\' '\n # Fallback. Ignored in presence of a nonce\n '\\'unsafe-inline\\' '\n # Fallback. Ignored in presence of strict-dynamic.\n 'https: http:',\n 'report-uri': '/csp',\n 'reportOnly': DEBUG,\n}\n" }, { "path": "python/base/handlers.py", "content": "# Copyright 2014 Google Inc. All rights reserved.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\"\"\"A collection of secure base handlers for webapp2-based applications.\"\"\"\n\nimport abc\nimport base64\nimport django.conf\nimport django.template\nimport django.template.loader\nimport functools\n\nimport json\nimport webapp2\nfrom webapp2_extras import jinja2\n\nimport api_fixer\nimport constants\nimport models\nimport os\nimport xsrf\n\nfrom google.appengine.api import memcache\nfrom google.appengine.api import users\n\n\n# Django initialization.\ndjango.conf.settings.configure(DEBUG=constants.DEBUG,\n TEMPLATE_DEBUG=constants.DEBUG,\n TEMPLATE_DIRS=[constants.TEMPLATE_DIR])\n\n\n# Assorted decorators that can be used inside a webapp2.RequestHandler object\n# to assert certain preconditions before entering any method.\ndef requires_auth(f):\n \"\"\"A decorator that requires a currently logged in user.\"\"\"\n @functools.wraps(f)\n def wrapper(self, *args, **kwargs):\n if not users.get_current_user():\n self.DenyAccess()\n else:\n return f(self, *args, **kwargs)\n return wrapper\n\n\ndef requires_admin(f):\n \"\"\"A decorator that requires a currently logged in administrator.\"\"\"\n @functools.wraps(f)\n def wrapper(self, *args, **kwargs):\n if not users.is_current_user_admin():\n self.DenyAccess()\n else:\n return f(self, *args, **kwargs)\n return wrapper\n\n\ndef xsrf_protected(f):\n \"\"\"Decorator to validate XSRF tokens for any verb but GET, HEAD, OPTIONS.\"\"\"\n @functools.wraps(f)\n def wrapper(self, *args, **kwargs):\n non_xsrf_protected_verbs = ['options', 'head', 'get']\n if (self.request.method.lower() in non_xsrf_protected_verbs or\n self._RequestContainsValidXsrfToken()):\n return f(self, *args, **kwargs)\n else:\n self.XsrfFail()\n return wrapper\n\n\n# Utility functions.\ndef _GetXsrfKey():\n \"\"\"Returns the current key for generating and verifying XSRF tokens.\"\"\"\n client = memcache.Client()\n xsrf_key = client.get('xsrf_key')\n if not xsrf_key:\n config = models.GetApplicationConfiguration()\n xsrf_key = config.xsrf_key\n client.set('xsrf_key', xsrf_key)\n return xsrf_key\n\n\ndef _GetCspNonce():\n \"\"\"Returns a random CSP nonce.\"\"\"\n nonce_length = constants.NONCE_LENGTH\n return base64.b64encode(os.urandom(nonce_length * 2))[:nonce_length]\n\n\n# Classes with a __metaclass__ of _HandlerMeta may not contain any methods\n# with these names. This is checked when the class is instantiated.\n_RESTRICTED_FUNCTION_LIST = [\n 'dispatch',\n '_RequestContainsValidXsrfToken',\n]\n\n# Classes with these names (and _HandlerMeta as a metaclass) can contain\n# functions in the _RESTRICTED_FUNCTION_LIST. Note that there is no\n# package/module specified, so it is possible to bypass this check through\n# clever (or malicious) naming.\n_RESTRICTED_FUNCTION_CLASS_WHITELIST = [\n 'BaseHandler',\n 'BaseAjaxHandler',\n 'BaseCronHandler',\n 'BaseTaskHandler',\n 'AuthenticatedHandler',\n 'AuthenticatedAjaxHandler',\n 'AdminHandler',\n 'AdminAjaxHandler',\n]\n\n# This prefix is returned on GET requests to any Ajax-like handler.\n# It is used to prevent JSON-like responses that may contain non-public\n# information from being included in malicious domains, e.g. evil.com\n# inserting a tag like: .\n# evil.com cannot strip this prefix before parsing the result, unlike\n# same-origin requests. See https://google-gruyere.appspot.com/part3\n# for more information. It is not necessary for POST requests because\n# there is no way to force the browser to make a cross-domain POST request\n# and interpret the response as Javascript without use of other mechanisms\n# like Cross-Origin-Resource-Sharing, which is disabled by default.\n_XSSI_PREFIX = ')]}\\',\\n'\n\n\nclass SecurityError(Exception):\n pass\n\n\nclass _HandlerMeta(abc.ABCMeta):\n \"\"\"Metaclass for our secure base handlers.\n\n When a class with this metaclass is defined, the fields\n are checked to ensure that certain methods we would like to approximate as\n 'final' are not declared in subclasses. This is because we provide a\n default implementation which enforces various security related functionality.\n\n Class names that can bypass this whitelist are listed in\n _RESTRICTED_FUNCTION_CLASS_WHITELIST. Restricted methods are listed in\n _RESTRICTED_FUNCTION_LIST.\n \"\"\"\n\n def __new__(mcs, name, bases, dct):\n if name not in _RESTRICTED_FUNCTION_CLASS_WHITELIST:\n for func in _RESTRICTED_FUNCTION_LIST:\n if func in dct:\n raise SecurityError('%s attempts to override restricted method %s' %\n (name, func))\n return super(_HandlerMeta, mcs).__new__(mcs, name, bases, dct)\n\n\nclass BaseHandler(webapp2.RequestHandler):\n \"\"\"Base handler for servicing unauthenticated user requests.\"\"\"\n\n __metaclass__ = _HandlerMeta\n\n def __init__(self, request, response):\n self.initialize(request, response)\n api_fixer.ReplaceDefaultArgument(response.set_cookie.im_func, 'secure',\n not constants.IS_DEV_APPSERVER)\n api_fixer.ReplaceDefaultArgument(response.set_cookie.im_func, 'httponly',\n True)\n if self.current_user:\n self._xsrf_token = xsrf.GenerateToken(_GetXsrfKey(),\n self.current_user.email())\n if self.app.config.get('using_angular', constants.DEFAULT_ANGULAR):\n # AngularJS requires a JS readable XSRF-TOKEN cookie and will pass this\n # back in AJAX requests.\n self.response.set_cookie('XSRF-TOKEN', self._xsrf_token, httponly=False)\n else:\n self._xsrf_token = None\n\n self.csp_nonce = _GetCspNonce()\n\n self._RawWrite = self.response.out.write\n self.response.out.write = self._ReplacementWrite\n\n # All content should be rendered through a template system to reduce the\n # risk/likelihood of XSS issues. Access to the original function\n # self.response.out.write is available via self._RawWrite for exceptional\n # circumstances.\n def _ReplacementWrite(*args, **kwargs):\n raise SecurityError('All response content must originate via render() or'\n 'render_json()')\n\n def _SetCommonResponseHeaders(self):\n \"\"\"Sets various headers with security implications.\"\"\"\n frame_policy = self.app.config.get('framing_policy', constants.DENY)\n frame_header_value = constants.X_FRAME_OPTIONS_VALUES.get(frame_policy, '')\n if frame_header_value:\n self.response.headers['X-Frame-Options'] = frame_header_value\n\n hsts_policy = self.app.config.get('hsts_policy',\n constants.DEFAULT_HSTS_POLICY)\n if self.request.scheme.lower() == 'https' and hsts_policy:\n include_subdomains = bool(hsts_policy.get('includeSubdomains', False))\n subdomain_string = '; includeSubdomains' if include_subdomains else ''\n hsts_value = 'max-age=%d%s' % (int(hsts_policy.get('max_age')),\n subdomain_string)\n self.response.headers['Strict-Transport-Security'] = hsts_value\n\n self.response.headers['X-XSS-Protection'] = '1; mode=block'\n self.response.headers['X-Content-Type-Options'] = 'nosniff'\n\n csp_policy = self.app.config.get('csp_policy', constants.DEFAULT_CSP_POLICY)\n report_only = False\n if 'reportOnly' in csp_policy:\n report_only = csp_policy.get('reportOnly')\n csp_policy = csp_policy.copy()\n del csp_policy['reportOnly']\n header_name = ('Content-Security-Policy%s' %\n ('-Report-Only' if report_only else ''))\n directives = []\n for (k, v) in csp_policy.iteritems():\n directives.append('%s %s' % (k, v))\n csp = '; '.join(directives)\n\n # Set random nonce per response\n csp = csp % {'nonce_value': self.csp_nonce}\n\n self.response.headers.add(header_name, csp)\n\n @webapp2.cached_property\n def current_user(self):\n return users.get_current_user()\n\n def dispatch(self):\n self._SetCommonResponseHeaders()\n super(BaseHandler, self).dispatch()\n\n\n @classmethod\n def get_jinja2_config(cls):\n \"\"\"\n Builds Jinja2 config based on constants.\n\n Note: this is used in the factory below, but an alternative way of setting\n up Jinja2 would be to use the WSGIApplication config to set this and not\n use the factory below. This has the advantage of having different settings\n for different applications and not set here at the handler level.\n \"\"\"\n extensions = ['jinja2.ext.with_']\n return {\n 'environment_args': {\n 'autoescape': True,\n 'extensions': extensions,\n 'auto_reload': constants.DEBUG,\n },\n 'template_path': constants.TEMPLATE_DIR\n }\n\n @staticmethod\n def j2_factory(app):\n \"\"\"\n The factory function passed to get_jinja2.\n Args:\n app: the WSGIApplication\n \"\"\"\n return jinja2.Jinja2(app, BaseHandler.get_jinja2_config())\n\n @webapp2.cached_property\n def jinja2(self):\n \"\"\"\n Get the cached Jinja2 instance from the app registry, if none exists\n the factory function is used to create one.\n \"\"\"\n return jinja2.get_jinja2(self.j2_factory, app=self.app)\n\n def render_to_string(self, template, template_values=None):\n \"\"\"Renders template_name with template_values and returns as a string.\"\"\"\n if not template_values:\n template_values = {}\n\n template_values['_xsrf'] = self._xsrf_token\n template_values['_csp_nonce'] = self.csp_nonce\n template_strategy = self.app.config.get('template', constants.CLOSURE)\n\n if template_strategy == constants.DJANGO:\n t = django.template.loader.get_template(template)\n template_values = django.template.Context(template_values)\n return t.render(template_values)\n elif template_strategy == constants.JINJA2:\n return self.jinja2.render_template(template, **template_values)\n else:\n ijdata = { 'csp_nonce': self.csp_nonce }\n return template(template_values, ijdata)\n\n def render(self, template, template_values=None):\n \"\"\"Renders template with template_values and writes to the response.\"\"\"\n template_strategy = self.app.config.get('template', constants.CLOSURE)\n self._RawWrite(self.render_to_string(template, template_values))\n\n\nclass BaseCronHandler(BaseHandler):\n \"\"\"Base handler for servicing Cron requests.\n\n This handler enforces that inbound requests contain the X-AppEngine-Cron\n header, which AppEngine guarantees is only present on actual invocations\n according to the cron schedule, or crafted requests by an administrator\n of the application (the header is filtered out from normal user requests).\n \"\"\"\n\n __metaclass__ = _HandlerMeta\n\n def dispatch(self):\n header = self.request.headers.get('X-AppEngine-Cron', 'false')\n if header != 'true':\n raise SecurityError('attempt to access cron handler without '\n 'X-AppEngine-Cron header')\n super(BaseCronHandler, self).dispatch()\n\n\nclass BaseTaskHandler(BaseHandler):\n \"\"\"Base handler for servicing task requests.\n\n This handler enforces that inbound requests contain the X-AppEngine-QueueName\n header, which AppEngine guarantees is only present on requests from the\n Task Queue API, or crafted requests by an administrator of the application\n (the header is filtered out from normal user requests).\n \"\"\"\n\n __metaclass__ = _HandlerMeta\n\n def dispatch(self):\n header = self.request.headers.get('X-AppEngine-QueueName', None)\n if not header:\n raise SecurityError('attempt to access task handler without '\n 'X-AppEngine-QueueName header')\n super(BaseTaskHandler, self).dispatch()\n\n\nclass BaseAjaxHandler(BaseHandler):\n \"\"\"Base handler for servicing unauthenticated AJAX requests.\n\n Responses to GET requests will be prefixed by _XSSI_PREFIX. Requests\n using other HTTP verbs will not include such a prefix.\n \"\"\"\n\n __metaclass__ = _HandlerMeta\n\n def _SetAjaxResponseHeaders(self):\n self.response.headers['Content-Disposition'] = 'attachment; filename=json'\n self.response.headers['Content-Type'] = 'application/json; charset=utf-8'\n\n def dispatch(self):\n self._SetAjaxResponseHeaders()\n if self.request.method.lower() == 'get':\n self._RawWrite(_XSSI_PREFIX)\n super(BaseAjaxHandler, self).dispatch()\n\n def render(self, *args, **kwargs):\n raise SecurityError('AJAX handlers must use render_json()')\n\n def render_json(self, obj):\n self._RawWrite(json.dumps(obj))\n\n\nclass AuthenticatedHandler(BaseHandler):\n \"\"\"Base handler for servicing authenticated user requests.\n\n Implementations should provide an implementation of DenyAccess()\n and XsrfFail() to handle unauthenticated requests or invalid XSRF tokens.\n\n POST requests will be rejected unless the request contains a\n parameter named 'xsrf' which is a valid XSRF token for the\n currently authenticated user.\n \"\"\"\n\n __metaclass__ = _HandlerMeta\n\n @requires_auth\n @xsrf_protected\n def dispatch(self):\n super(AuthenticatedHandler, self).dispatch()\n\n def _RequestContainsValidXsrfToken(self):\n token = self.request.get('xsrf') or self.request.headers.get('X-XSRF-TOKEN')\n # By default, Angular's $http service will add quotes around the\n # X-XSRF-TOKEN.\n if (token and\n self.app.config.get('using_angular', constants.DEFAULT_ANGULAR) and\n token[0] == '\"' and token[-1] == '\"'):\n token = token[1:-1]\n\n if xsrf.ValidateToken(_GetXsrfKey(), self.current_user.email(),\n token):\n return True\n return False\n\n @abc.abstractmethod\n def DenyAccess(self):\n pass\n\n @abc.abstractmethod\n def XsrfFail(self):\n pass\n\n\nclass AuthenticatedAjaxHandler(BaseAjaxHandler):\n \"\"\"Base handler for servicing AJAX requests.\n\n Implementations should provide an implementation of DenyAccess()\n and XsrfFail() to handle unauthenticated requests or invalid XSRF tokens.\n\n POST requests will be rejected unless the request contains a\n parameter named 'xsrf', OR an HTTP header named 'X-XSRF-Token'\n which is a valid XSRF token for the currently authenticated user.\n\n Responses to GET requests will be prefixed by _XSSI_PREFIX. Requests\n using other HTTP verbs will not include such a prefix.\n \"\"\"\n\n __metaclass__ = _HandlerMeta\n\n @requires_auth\n @xsrf_protected\n def dispatch(self):\n super(AuthenticatedAjaxHandler, self).dispatch()\n\n def _RequestContainsValidXsrfToken(self):\n token = self.request.get('xsrf') or self.request.headers.get('X-XSRF-Token')\n # By default, Angular's $http service will add quotes around the\n # X-XSRF-TOKEN.\n if (token and\n self.app.config.get('using_angular', constants.DEFAULT_ANGULAR) and\n token[0] == '\"' and token[-1] == '\"'):\n token = token[1:-1]\n\n if xsrf.ValidateToken(_GetXsrfKey(), self.current_user.email(),\n token):\n return True\n return False\n\n @abc.abstractmethod\n def DenyAccess(self):\n pass\n\n @abc.abstractmethod\n def XsrfFail(self):\n pass\n\n\nclass AdminHandler(AuthenticatedHandler):\n \"\"\"Base handler for servicing administrator requests.\n\n Implementations should provide an implementation of DenyAccess()\n and XsrfFail() to handle unauthenticated requests or invalid XSRF tokens.\n\n Requests will be rejected if the currently logged in user is\n not an administrator.\n\n POST requests will be rejected unless the request contains a\n parameter named 'xsrf' which is a valid XSRF token for the\n currently authenticated user.\n \"\"\"\n\n __metaclass__ = _HandlerMeta\n\n @requires_admin\n def dispatch(self):\n super(AdminHandler, self).dispatch()\n\n\nclass AdminAjaxHandler(AuthenticatedAjaxHandler):\n \"\"\"Base handler for servicing AJAX administrator requests.\n\n Implementations should provide an implementation of DenyAccess()\n and XsrfFail() to handle unauthenticated requests or invalid XSRF tokens.\n\n Requests will be rejected if the currently logged in user is\n not an administrator.\n\n POST requests will be rejected unless the request contains a\n parameter named 'xsrf', OR an HTTP header named 'X-XSRF-Token'\n which is a valid XSRF token for the currently authenticated user.\n\n Responses to GET requests will be prefixed by _XSSI_PREFIX. Requests\n using other HTTP verbs will not include such a prefix.\n \"\"\"\n\n __metaclass__ = _HandlerMeta\n\n @requires_admin\n def dispatch(self):\n super(AdminAjaxHandler, self).dispatch()\n" }, { "path": "python/base/handlers_test.py", "content": "# Copyright 2014 Google Inc. All rights reserved.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\"\"\"Tests for base.handlers.\"\"\"\n\nimport exceptions\nimport unittest2\nimport webapp2\n\nimport handlers\nimport xsrf\n\nfrom google.appengine.ext import testbed\n\n\nclass DummyHandler(handlers.AuthenticatedHandler):\n \"\"\"Convenience class to verify successful requests.\"\"\"\n\n def get(self):\n self._RawWrite('get_succeeded')\n\n def post(self):\n self._RawWrite('post_succeeded')\n\n def DenyAccess(self):\n self._RawWrite('access_denied')\n\n def XsrfFail(self):\n self._RawWrite('xsrf_fail')\n\n\nclass DummyAjaxHandler(handlers.BaseAjaxHandler):\n \"\"\"Convenience class to verify successful requests.\"\"\"\n\n def get(self):\n pass\n\n def post(self):\n pass\n\n\nclass DummyCronHandler(handlers.BaseCronHandler):\n \"\"\"Convenience class to verify successful requests.\"\"\"\n\n def get(self):\n self._RawWrite('get_succeeded')\n\n\nclass DummyTaskHandler(handlers.BaseTaskHandler):\n \"\"\"Convenience class to verify successful requests.\"\"\"\n\n def get(self):\n self._RawWrite('get_succeeded')\n\n\nclass HandlersTest(unittest2.TestCase):\n \"\"\"Test cases for base.handlers.\"\"\"\n\n def setUp(self):\n self.testbed = testbed.Testbed()\n self.testbed.activate()\n self.testbed.init_datastore_v3_stub()\n self.testbed.init_memcache_stub()\n self.app = webapp2.WSGIApplication([('/', DummyHandler),\n ('/ajax', DummyAjaxHandler),\n ('/cron', DummyCronHandler),\n ('/task', DummyTaskHandler)])\n\n def _FakeLogin(self):\n \"\"\"Sets up the environment to have a fake user logged in.\"\"\"\n self.testbed.setup_env(\n USER_EMAIL='user@example.com',\n USER_ID='123',\n overwrite=True)\n\n def testHandlerCannotOverrideFinalMethods(self):\n\n try:\n\n class _(handlers.BaseHandler):\n\n def dispatch(self):\n pass\n\n self.fail('should not be able to override dispatch')\n except handlers.SecurityError, e:\n self.assertTrue(e.message.find('override restricted') != -1)\n\n def testAuthenticatedHandlerRequiresUser(self):\n\n self.assertEqual('access_denied', self.app.get_response('/').body)\n self.assertEqual('access_denied', self.app.get_response('/',\n method='POST').body)\n self._FakeLogin()\n self.assertEqual('get_succeeded', self.app.get_response('/').body)\n\n def testXsrfProtectionFailsWithInvalidToken(self):\n self._FakeLogin()\n self.assertEqual('xsrf_fail', self.app.get_response('/',\n method='POST',\n POST={}).body)\n\n def testXsrfProtectionSucceedsWithValidToken(self):\n self._FakeLogin()\n\n key = handlers._GetXsrfKey()\n token = xsrf.GenerateToken(key, 'user@example.com')\n self.assertEqual('post_succeeded',\n self.app.get_response('/',\n method='POST',\n POST={'xsrf': token}).body)\n\n def testResponseHasStrictCSP(self):\n \"\"\"Checks that the CSP in the response is set and strict.\n More information: https://www.w3.org/TR/CSP3/#strict-dynamic-usage\n \"\"\"\n fakeNonce = 'rand0m123'\n strictScriptSrc = ['\\'strict-dynamic\\'', '\\'nonce-%s\\'' % fakeNonce]\n strictObjectSrc = ['\\'none\\'']\n\n handlers._GetCspNonce = lambda : fakeNonce\n\n headers = self.app.get_response('/', method='GET').headers\n csp_header = headers.get('Content-Security-Policy')\n self.assertIsNotNone(csp_header)\n csp = {x.split()[0]: x.split()[1:] for x in csp_header.split(';')}\n\n # Check that csp contains a nonce and the stict-dynamic keyword.\n self.assertTrue(set(strictScriptSrc) <= set(csp.get('script-src')))\n self.assertListEqual(strictObjectSrc, csp.get('object-src'))\n\n def testAjaxGetResponsesIncludeXssiPrefix(self):\n self.assertEqual(handlers._XSSI_PREFIX, self.app.get_response('/ajax').body)\n\n def testAjaxPostResponsesLackXssiPrefix(self):\n self.assertEqual('', self.app.get_response('/ajax', method='POST').body)\n\n def testCronFailsWithoutXAppEngineCron(self):\n try:\n self.app.get_response('/cron', method='GET')\n self.fail('Cron succeeded without X-AppEngine-Cron: true header')\n except exceptions.AssertionError, e:\n # webapp2 wraps the raised SecurityError during dispatch with an\n # exceptions.AssertionError.\n self.assertTrue(e.message.find('X-AppEngine-Cron') != -1)\n\n def testCronSucceedsWithXAppEngineCron(self):\n headers = [('X-AppEngine-Cron', 'true')]\n self.assertEqual('get_succeeded',\n self.app.get_response('/cron',\n headers=headers).body)\n\n def testTaskFailsWithoutXAppEngineQueueName(self):\n try:\n self.app.get_response('/task', method='GET')\n self.fail('Task succeeded without X-AppEngine-QueueName header')\n except exceptions.AssertionError, e:\n # webapp2 wraps the raised SecurityError during dispatch with an\n # exceptions.AssertionError.\n self.assertTrue(e.message.find('X-AppEngine-QueueName') != -1)\n\n def testTaskSucceedsWithXAppEngineQueueName(self):\n headers = [('X-AppEngine-QueueName', 'default')]\n self.assertEqual('get_succeeded',\n self.app.get_response('/task',\n headers=headers).body)\n\nif __name__ == '__main__':\n unittest2.main()\n" }, { "path": "python/base/models.py", "content": "# Copyright 2014 Google Inc. All rights reserved.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\"\"\"Framework wide datastore models.\"\"\"\n\nfrom google.appengine.ext import ndb\n\nimport os\n\n@ndb.transactional\ndef GetApplicationConfiguration():\n \"\"\"Returns the application configuration, creating it if necessary.\"\"\"\n key = ndb.Key(Config, 'config')\n entity = key.get()\n if not entity:\n entity = Config(key=key)\n entity.xsrf_key = os.urandom(16)\n entity.put()\n return entity\n\n\nclass Config(ndb.Model):\n \"\"\"A simple key-value store for application configuration settings.\"\"\"\n\n xsrf_key = ndb.BlobProperty()\n" }, { "path": "python/base/models_test.py", "content": "# Copyright 2014 Google Inc. All rights reserved.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\"\"\"Tests for base.models.\"\"\"\n\nimport unittest2\n\nimport models\n\nfrom google.appengine.ext import testbed\n\n\nclass ModelsTest(unittest2.TestCase):\n \"\"\"Test cases for base.models.\"\"\"\n\n def setUp(self):\n self.testbed = testbed.Testbed()\n self.testbed.activate()\n self.testbed.init_datastore_v3_stub()\n\n def testConfigurationAutomaticallyGenerated(self):\n config = models.GetApplicationConfiguration()\n self.assertIsNotNone(config)\n self.assertIsNotNone(config.xsrf_key)\n\n\nif __name__ == '__main__':\n unittest2.main()\n" }, { "path": "python/base/xsrf.py", "content": "# Copyright 2014 Google Inc. All rights reserved.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\"\"\"Utilities related to Cross-Site Request Forgery protection.\"\"\"\n\nimport hashlib\nimport hmac\nimport time\n\nDELIMITER_ = ':'\nDEFAULT_TIMEOUT_ = 86400\n\n\ndef _Compare(a, b):\n \"\"\"Compares a and b in constant time and returns True if they are equal.\"\"\"\n if len(a) != len(b):\n return False\n result = 0\n for x, y in zip(a, b):\n result |= ord(x) ^ ord(y)\n\n return result == 0\n\n\ndef GenerateToken(key, user, action='*', now=None):\n \"\"\"Generates an XSRF token for the provided user and action.\"\"\"\n token_timestamp = now or int(time.time())\n message = DELIMITER_.join([user, action, str(token_timestamp)])\n digest = hmac.new(key, message, hashlib.sha1).hexdigest()\n return DELIMITER_.join([str(token_timestamp), digest])\n\n\ndef ValidateToken(key, user, token, action='*', max_age=DEFAULT_TIMEOUT_):\n \"\"\"Validates the provided XSRF token.\"\"\"\n if not token or not user:\n return False\n try:\n (timestamp, digest) = token.split(DELIMITER_)\n except ValueError:\n return False\n expected = GenerateToken(key, user, action, timestamp)\n (_, expected_digest) = expected.split(DELIMITER_)\n now = int(time.time())\n if _Compare(expected_digest, digest) and now < int(timestamp) + max_age:\n return True\n return False\n" }, { "path": "python/base/xsrf_test.py", "content": "# Copyright 2014 Google Inc. All rights reserved.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\"\"\"Tests for base.xsrf.\"\"\"\n\nimport os\nimport time\nimport unittest2\n\nimport xsrf\n\n\nclass XsrfTest(unittest2.TestCase):\n \"\"\"Test cases for base.xsrf.\"\"\"\n\n def setUp(self):\n # non-deterministic tests FTW!\n self.key = os.urandom(16)\n\n def testCompare(self):\n self.assertTrue(xsrf._Compare('a', 'a'))\n self.assertFalse(xsrf._Compare('a', 'b'))\n self.assertFalse(xsrf._Compare('a', 'ab'))\n\n def testTokenWithNoActionVerifies(self):\n token = xsrf.GenerateToken(self.key, 'user')\n self.assertTrue(xsrf.ValidateToken(self.key, 'user', token))\n\n def testTokenWithDifferentActionsFail(self):\n token = xsrf.GenerateToken(self.key, 'user', 'a')\n self.assertFalse(xsrf.ValidateToken(self.key, 'user', token, 'b'))\n\n def testTokenWithDifferentUsersFail(self):\n token = xsrf.GenerateToken(self.key, 'user')\n self.assertFalse(xsrf.ValidateToken(self.key, 'otheruser', token))\n\n def testExpiredTokenDoesNotVerify(self):\n now = int(time.time()) - (xsrf.DEFAULT_TIMEOUT_ + 1)\n token = xsrf.GenerateToken(self.key, 'user', '*', now)\n self.assertFalse(xsrf.ValidateToken(self.key, 'user', token))\n self.assertTrue(xsrf.ValidateToken(self.key, 'user', token, '*',\n xsrf.DEFAULT_TIMEOUT_ * 2))\n\n\nif __name__ == '__main__':\n unittest2.main()\n" }, { "path": "python/country_servers.py", "content": "# Copyright 2017 Google Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\nimport sys\nfrom random import randint\nfrom google.appengine.ext import ndb\nimport logging\n\n# the top level of your domain in which you'll run backend servers, e.g. your-domain.com\ndomain = '
86 2 2 60 1 1 38 0 0 84 3 3 86 2 2 38 0 0 68 10 10 2 9 9 1 8 8 67 4 4 68 10 10 1 8 8 76 14 16 19 13 15 3 12 14 69 11 11 76 14 16 3 12 14 71 19 22 5 18 21 4 17 20 70 15 17 71 19 22 4 17 20 78 28 32 21 27 31 20 26 30 77 29 33 78 28 32 20 26 30 79 31 35 22 30 34 21 27 31 78 28 32 79 31 35 21 27 31 75 35 41 18 34 40 8 33 39 74 32 36 75 35 41 8 33 39 81 61 73 29 60 72 33 59 71 83 25 28 81 61 73 33 59 71 61 74 81 29 60 72 81 61 73 87 63 78 61 74 81 81 61 73 1 8 8 0 67 82 66 7 7 67 4 4 1 8 8 66 7 7 3 12 14 2 9 9 68 10 10 69 11 11 3 12 14 68 10 10 4 17 20 19 13 15 76 14 16 70 15 17 4 17 20 76 14 16 6 70 83 5 18 21 71 19 22 72 20 23 6 70 83 71 19 22 7 68 84 6 70 83 72 20 23 73 23 26 7 68 84 72 20 23 33 59 71 7 68 84 73 23 26 83 25 28 33 59 71 73 23 26 8 33 39 22 30 34 79 31 35 74 32 36 8 33 39 79 31 35 32 65 88 28 78 87 80 53 63 82 52 60 32 65 88 80 53 63 20 26 30 39 73 89 85 56 66 77 29 33 20 26 30 85 56 66 0 67 82 32 65 88 82 52 60 66 7 7 0 67 82 82 52 60 38 0 0 18 34 91 75 35 76 84 3 3 38 0 0 75 35 76 39 73 89 61 74 81 87 63 78 85 56 66 39 73 89 87 63 78 28 78 87 60 1 1 86 2 2 80 53 63 28 78 87 86 2 2
\n\t\t\t\t23 6 6 24 5 5 67 4 4 66 7 7 23 6 6 67 4 4 25 10 13 26 11 12 69 11 11 68 10 10 25 10 13 69 11 11 10 16 19 11 15 18 70 15 17 76 14 16 10 16 19 70 15 17 12 22 25 13 21 24 72 20 23 71 19 22 12 22 25 72 20 23 13 21 24 14 24 27 73 23 26 72 20 23 13 21 24 73 23 26 14 24 27 34 25 29 83 25 28 73 23 26 14 24 27 83 25 28 17 31 38 27 32 37 74 32 36 79 31 35 17 31 38 74 32 36 53 38 44 48 37 43 49 36 42 51 39 45 53 38 44 49 36 42 51 39 45 52 40 46 53 38 44 40 43 49 47 42 48 57 41 47 56 41 50 40 43 49 57 41 47 46 44 51 47 42 48 40 43 49 41 45 52 46 44 51 40 43 49 44 47 54 45 46 53 46 44 51 50 48 55 44 47 54 46 44 51 50 48 55 46 44 51 41 45 52 43 49 56 50 48 55 41 45 52 41 45 52 42 50 57 43 49 56 37 51 59 36 51 58 9 51 42 15 51 45 37 51 59 9 51 42 15 51 45 9 51 42 17 51 44 16 51 46 15 51 45 17 51 44 27 51 43 17 51 44 9 51 42 24 51 52 23 51 49 14 51 48 13 51 51 24 51 52 14 51 48 26 51 56 25 51 57 24 51 52 10 51 55 26 51 56 24 51 52 10 51 55 24 51 52 13 51 51 11 51 54 10 51 55 13 51 51 13 51 51 12 51 53 11 51 54 30 53 62 35 52 61 82 52 60 80 53 63 30 53 62 82 52 60 37 55 65 15 54 64 77 29 33 85 56 66 37 55 65 77 29 33 65 58 69 64 58 68 54 57 67 55 57 70 65 58 69 54 57 67 14 51 48 23 51 49 35 51 50 34 51 47 14 51 48 35 51 50 55 57 70 54 57 67 56 41 50 57 41 47 55 57 70 56 41 50 35 52 61 23 6 6 66 7 7 82 52 60 35 52 61 66 7 7 30 51 67 31 51 70 34 51 47 35 51 50 30 51 67 34 51 47 75 35 76 9 35 75 36 3 74 84 3 3 75 35 76 36 3 74 63 51 69 62 51 68 36 51 58 37 51 59 63 51 69 36 51 58 87 63 78 63 62 77 37 55 65 85 56 66 87 63 78 37 55 65 51 39 45 49 36 42 58 64 58 59 64 59 51 39 45 58 64 58 48 37 43 53 38 44 22 30 44 8 33 43 48 37 43 22 30 44 49 36 42 48 37 43 8 33 43 18 34 42 49 36 42 8 33 43 52 40 46 51 39 45 20 26 45 21 27 46 52 40 46 20 26 45 53 38 44 52 40 46 21 27 46 22 30 44 53 38 44 21 27 46 40 43 49 56 66 50 32 65 50 0 67 49 40 43 49 32 65 50 57 69 47 47 42 48 7 68 48 33 59 47 57 69 47 7 68 48 41 45 52 40 43 49 0 67 49 1 8 52 41 45 52 0 67 49 47 42 48 46 44 51 6 70 51 7 68 48 47 42 48 6 70 51 44 47 54 50 48 55 19 13 55 4 17 54 44 47 54 19 13 55 45 46 53 44 47 54 4 17 54 5 18 53 45 46 53 4 17 54 46 44 51 45 46 53 5 18 53 6 70 51 46 44 51 5 18 53 50 48 55 43 49 56 3 12 56 19 13 55 50 48 55 3 12 56 42 50 57 41 45 52 1 8 52 2 9 57 42 50 57 1 8 52 43 49 56 42 50 57 2 9 57 3 12 56 43 49 56 2 9 57 39 73 59 59 72 59 65 71 69 61 74 79 39 73 59 65 71 69 64 76 68 58 75 58 38 0 58 60 1 68 64 76 68 38 0 58 55 77 70 57 69 47 33 59 47 29 60 70 55 77 70 33 59 47 56 66 50 54 79 67 28 78 67 32 65 50 56 66 50 28 78 67 51 39 45 59 72 59 39 73 59 20 26 45 51 39 45 39 73 59 58 75 58 49 36 42 18 34 42 38 0 58 58 75 58 18 34 42 62 2 80 30 53 62 80 53 63 86 2 2 62 2 80 80 53 63 59 64 59 58 64 58 64 58 68 65 58 69 59 64 59 64 58 68 31 51 70 30 51 67 62 51 68 63 51 69 31 51 70 62 51 68 55 77 70 29 60 70 61 74 79 65 71 69 55 77 70 61 74 79 28 78 67 54 79 67 64 76 68 60 1 68 28 78 67 64 76 68 36 3 74 62 2 80 86 2 2 84 3 3 36 3 74 86 2 2 24 5 5 25 10 13 68 10 10 67 4 4 24 5 5 68 10 10 26 11 12 10 16 19 76 14 16 69 11 11 26 11 12 76 14 16 11 15 18 12 22 25 71 19 22 70 15 17 11 15 18 71 19 22 15 54 64 16 28 85 78 28 32 77 29 33 15 54 64 78 28 32 16 28 85 17 31 38 79 31 35 78 28 32 16 28 85 79 31 35 27 32 37 9 35 86 75 35 41 74 32 36 27 32 37 75 35 41 34 25 29 31 80 90 81 61 73 83 25 28 34 25 29 81 61 73 31 80 90 63 62 77 87 63 78 81 61 73 31 80 90 87 63 78
\n\t\t\t\t4 0 2 38 0 1 5 0 0 38 0 1 37 0 7 5 0 0 4 0 2 46 0 10 38 0 1 4 0 15 6 0 14 23 0 13 7 0 23 43 0 22 40 0 21 12 0 26 1 0 25 11 0 24 39 0 33 44 0 0 42 0 32 36 0 30 7 0 34 39 0 33 9 0 27 6 0 36 11 0 35 9 0 27 45 0 28 6 0 36 45 0 28 12 0 26 40 0 21 44 0 37 38 0 1 46 0 10 45 0 28 42 0 39 27 0 38 4 0 2 23 0 13 46 0 10 39 0 41 5 0 40 37 0 7 7 0 34 5 0 42 39 0 33 44 27 44 39 27 43 39 27 43 40 0 21 12 0 26 11 0 24 6 0 36 4 0 29 11 0 35 45 0 28 27 0 38 6 0 36 42 0 39 44 0 45 27 0 38 36 0 30 43 0 22 7 0 34 11 0 24 7 0 23 40 0 21 11 0 35 1 0 25 9 0 27 36 0 30 39 0 33 42 0 32 42 0 39 45 0 28 40 0 21 27 0 19 44 0 37 46 0 10 39 27 43 44 27 44 39 27 43 166 103 1 134 103 2 135 103 0 134 108 29 141 108 48 11 108 47 165 103 7 166 103 1 135 103 0 135 109 23 134 109 24 4 109 2 174 103 10 134 103 2 166 103 1 135 111 42 5 111 29 137 111 47 136 103 14 134 103 15 152 103 13 171 103 22 137 103 23 168 103 21 132 103 25 142 103 26 141 103 24 4 108 42 134 108 29 11 108 47 5 109 0 135 109 23 4 109 2 172 103 0 167 103 33 170 103 32 137 103 34 164 103 30 167 103 33 136 103 36 139 103 27 141 103 35 173 103 28 139 103 27 136 103 36 142 103 26 173 103 28 168 103 21 166 103 1 172 103 37 174 103 10 170 103 39 173 103 28 156 103 38 152 103 13 134 103 2 174 103 10 135 103 40 167 103 41 165 103 7 7 123 23 11 123 24 141 123 2 135 103 42 137 103 34 167 103 33 167 27 43 172 27 44 167 27 43 142 103 26 168 103 21 141 103 24 134 103 29 136 103 36 141 103 35 156 103 38 173 103 28 136 103 36 172 103 45 170 103 39 156 103 38 5 111 29 7 111 48 137 111 47 137 123 0 7 123 23 141 123 2 171 103 22 164 103 30 137 103 34 137 103 23 141 103 24 168 103 21 132 103 25 141 103 35 139 103 27 167 103 33 164 103 30 170 103 32 173 103 28 170 103 39 168 103 21 172 103 37 156 103 19 174 103 10 172 27 44 167 27 43 167 27 43
\n\t\t\t\t2 3 5 122 2 4 121 1 3 121 1 3 80 4 6 2 3 5 200 7 6 230 6 3 161 5 5 230 6 3 200 7 6 181 8 8 79 9 9 2 3 5 80 4 6 248 11 12 247 10 11 161 5 5 24 0 17 8 0 7 47 0 16 106 13 12 56 12 18 122 2 4 19 0 20 35 0 19 34 0 13 48 0 28 21 0 27 25 0 26 229 14 4 161 5 5 230 6 3 199 15 9 161 5 5 247 10 11 51 18 29 119 17 11 71 16 9 26 0 31 41 0 22 50 0 30 122 2 4 2 3 5 106 13 12 105 19 11 106 13 12 2 3 5 2 3 5 79 9 9 105 19 11 54 20 29 105 19 11 79 9 9 121 1 6 85 22 3 55 21 8 21 0 27 16 0 25 25 0 26 15 24 5 86 23 4 85 22 3 85 22 3 121 1 6 15 24 5 122 2 9 15 24 5 121 1 6 112 26 12 57 25 18 86 23 4 86 23 4 15 24 5 112 26 12 161 5 5 199 15 9 200 7 6 180 28 18 248 11 12 229 14 4 111 29 11 112 26 12 15 24 5 161 5 5 229 14 4 248 11 12 15 24 5 122 2 9 111 29 11 8 0 7 22 0 7 47 0 16 56 12 29 111 29 11 122 2 9 35 0 19 49 0 10 34 0 13 30 0 46 26 0 31 50 0 30 80 4 6 121 1 3 55 21 8 68 32 6 64 31 3 60 30 8 123 34 5 63 33 4 64 31 3 64 31 3 68 32 6 123 34 5 67 35 9 123 34 5 68 32 6 66 37 12 59 36 18 63 33 4 63 33 4 123 34 5 66 37 12 65 38 11 66 37 12 123 34 5 123 34 5 67 35 9 65 38 11 51 18 29 65 38 11 67 35 9 66 37 6 70 39 3 59 36 8 124 41 5 69 40 4 70 39 3 70 39 3 66 37 6 124 41 5 65 38 9 124 41 5 66 37 6 72 43 12 53 42 18 69 40 4 69 40 4 124 41 5 72 43 12 71 16 11 72 43 12 124 41 5 124 41 5 65 38 9 71 16 11 51 18 29 71 16 11 65 38 9 70 39 6 74 44 3 59 36 8 125 46 5 73 45 4 74 44 3 74 44 3 70 39 6 125 46 5 69 40 9 125 46 5 70 39 6 76 47 12 54 20 18 73 45 4 73 45 4 125 46 5 76 47 12 75 48 11 76 47 12 125 46 5 125 46 5 69 40 9 75 48 11 53 42 29 75 48 11 69 40 9 74 44 6 78 49 3 59 36 8 126 51 5 77 50 4 78 49 3 78 49 3 74 44 6 126 51 5 73 45 9 126 51 5 74 44 6 80 4 12 55 21 18 77 50 4 77 50 4 126 51 5 80 4 12 79 9 11 80 4 12 126 51 5 126 51 5 73 45 9 79 9 11 54 20 29 79 9 11 73 45 9 78 49 6 63 33 3 59 36 8 127 52 5 64 31 4 63 33 3 63 33 3 78 49 6 127 52 5 77 50 9 127 52 5 78 49 6 82 53 12 60 30 18 64 31 4 64 31 4 127 52 5 82 53 12 81 54 11 82 53 12 127 52 5 127 52 5 77 50 9 81 54 11 55 21 29 81 54 11 77 50 9 85 22 6 81 54 3 55 21 8 128 55 5 82 53 4 81 54 3 81 54 3 85 22 6 128 55 5 86 23 9 128 55 5 85 22 6 84 56 12 60 30 18 82 53 4 82 53 4 128 55 5 84 56 12 83 57 11 84 56 12 128 55 5 128 55 5 86 23 9 83 57 11 57 25 29 83 57 11 86 23 9 89 58 6 83 57 3 57 25 8 129 59 5 84 56 4 83 57 3 83 57 3 89 58 6 129 59 5 90 60 9 129 59 5 89 58 6 88 61 12 60 30 18 84 56 4 84 56 4 129 59 5 88 61 12 87 62 11 88 61 12 129 59 5 129 59 5 90 60 9 87 62 11 58 63 29 87 62 11 90 60 9 88 61 6 68 32 3 60 30 8 130 64 5 67 35 4 68 32 3 68 32 3 88 61 6 130 64 5 87 62 9 130 64 5 88 61 6 91 65 12 51 18 18 67 35 4 67 35 4 130 64 5 91 65 12 92 66 11 91 65 12 130 64 5 130 64 5 87 62 9 92 66 11 58 63 29 92 66 11 87 62 9 98 69 6 94 68 3 62 67 8 131 71 5 93 70 4 94 68 3 94 68 3 98 69 6 131 71 5 97 72 9 131 71 5 98 69 6 96 74 12 61 73 18 93 70 4 93 70 4 131 71 5 96 74 12 95 75 11 96 74 12 131 71 5 131 71 5 97 72 9 95 75 11 52 76 29 95 75 11 97 72 9 102 78 6 99 77 3 53 42 8 10 80 5 100 79 4 99 77 3 99 77 3 102 78 6 10 80 5 101 81 9 10 80 5 102 78 6 98 69 12 62 67 18 100 79 4 100 79 4 10 80 5 98 69 12 97 72 11 98 69 12 10 80 5 10 80 5 101 81 9 97 72 11 52 76 29 97 72 11 101 81 9 99 77 6 75 48 3 53 42 8 13 82 5 76 47 4 75 48 3 75 48 3 99 77 6 13 82 5 100 79 9 13 82 5 99 77 6 103 83 12 54 20 18 76 47 4 76 47 4 13 82 5 103 83 12 104 84 11 103 83 12 13 82 5 13 82 5 100 79 9 104 84 11 62 67 29 104 84 11 100 79 9 103 83 6 105 19 3 54 20 8 14 85 5 106 13 4 105 19 3 105 19 3 103 83 6 14 85 5 104 84 9 14 85 5 103 83 6 107 86 12 56 12 18 106 13 4 106 13 4 14 85 5 107 86 12 108 87 11 107 86 12 14 85 5 14 85 5 104 84 9 108 87 11 62 67 29 108 87 11 104 84 9 107 86 6 109 88 3 56 12 8 17 90 5 110 89 4 109 88 3 109 88 3 107 86 6 17 90 5 108 87 9 17 90 5 107 86 6 93 70 12 61 73 18 110 89 4 110 89 4 17 90 5 93 70 12 94 68 11 93 70 12 17 90 5 17 90 5 108 87 9 94 68 11 62 67 29 94 68 11 108 87 9 109 88 6 111 29 3 56 12 8 18 91 5 112 26 4 111 29 3 111 29 3 109 88 6 18 91 5 110 89 9 18 91 5 109 88 6 113 92 12 57 25 18 112 26 4 112 26 4 18 91 5 113 92 12 114 93 11 113 92 12 18 91 5 18 91 5 110 89 9 114 93 11 61 73 29 114 93 11 110 89 9 113 92 6 89 58 3 57 25 8 28 94 5 90 60 4 89 58 3 89 58 3 113 92 6 28 94 5 114 93 9 28 94 5 113 92 6 115 95 12 58 63 18 90 60 4 90 60 4 28 94 5 115 95 12 116 96 11 115 95 12 28 94 5 28 94 5 114 93 9 116 96 11 61 73 29 116 96 11 114 93 9 115 95 6 118 97 3 58 63 8 31 99 5 117 98 4 118 97 3 118 97 3 115 95 6 31 99 5 116 96 9 31 99 5 115 95 6 95 75 12 52 76 18 117 98 4 117 98 4 31 99 5 95 75 12 96 74 11 95 75 12 31 99 5 31 99 5 116 96 9 96 74 11 61 73 29 96 74 11 116 96 9 120 100 6 117 98 3 52 76 8 32 101 5 118 97 4 117 98 3 117 98 3 120 100 6 32 101 5 119 17 9 32 101 5 120 100 6 92 66 12 58 63 18 118 97 4 118 97 4 32 101 5 92 66 12 91 65 11 92 66 12 32 101 5 32 101 5 119 17 9 91 65 11 51 18 29 91 65 11 119 17 9 72 43 6 102 78 3 53 42 8 33 102 5 101 81 4 102 78 3 102 78 3 72 43 6 33 102 5 71 16 9 33 102 5 72 43 6 120 100 12 52 76 18 101 81 4 101 81 4 33 102 5 120 100 12 119 17 11 120 100 12 33 102 5 33 102 5 71 16 9 119 17 11 250 106 4 133 105 5 249 104 3 208 107 6 249 104 3 133 105 5 133 105 5 207 110 9 208 107 6 138 103 7 153 103 17 175 103 16 184 113 18 234 112 12 250 106 4 163 103 19 149 103 20 162 103 13 150 103 27 176 103 28 154 103 26 247 10 11 179 114 29 199 15 9 169 103 22 155 103 31 178 103 30 133 105 5 250 106 4 234 112 12 234 112 12 233 115 11 133 105 5 207 110 9 133 105 5 233 115 11 233 115 11 182 116 29 207 110 9 213 118 3 249 104 6 183 117 8 146 103 25 150 103 27 154 103 26 214 120 4 145 119 5 213 118 3 249 104 6 213 118 3 145 119 5 145 119 5 250 106 9 249 104 6 185 122 18 240 121 12 214 120 4 145 119 5 214 120 4 240 121 12 240 121 12 239 124 11 145 119 5 250 106 9 145 119 5 239 124 11 151 103 7 138 103 7 175 103 16 239 124 11 184 113 29 250 106 9 177 103 10 163 103 19 162 103 13 155 103 31 158 103 46 178 103 30 249 104 3 208 107 6 183 117 8 192 127 3 196 126 6 188 125 8 191 129 4 251 128 5 192 127 3 196 126 6 192 127 3 251 128 5 251 128 5 195 130 9 196 126 6 187 132 18 194 131 12 191 129 4 251 128 5 191 129 4 194 131 12 194 131 12 193 133 11 251 128 5 195 130 9 251 128 5 193 133 11 193 133 11 179 114 29 195 130 9 198 134 3 194 131 6 187 132 8 197 135 4 252 51 5 198 134 3 194 131 6 198 134 3 252 51 5 252 51 5 193 133 9 194 131 6 181 8 18 200 7 12 197 135 4 252 51 5 197 135 4 200 7 12 200 7 12 199 15 11 252 51 5 193 133 9 252 51 5 199 15 11 199 15 11 179 114 29 193 133 9 202 136 3 198 134 6 187 132 8 201 138 4 253 137 5 202 136 3 198 134 6 202 136 3 253 137 5 253 137 5 197 135 9 198 134 6 182 116 18 204 139 12 201 138 4 253 137 5 201 138 4 204 139 12 204 139 12 203 140 11 253 137 5 197 135 9 253 137 5 203 140 11 203 140 11 181 8 29 197 135 9 206 141 3 202 136 6 187 132 8 205 143 4 254 142 5 206 141 3 202 136 6 206 141 3 254 142 5 254 142 5 201 138 9 202 136 6 183 117 18 208 107 12 205 143 4 254 142 5 205 143 4 208 107 12 208 107 12 207 110 11 254 142 5 201 138 9 254 142 5 207 110 11 207 110 11 182 116 29 201 138 9 191 129 3 206 141 6 187 132 8 192 127 4 255 144 5 191 129 3 206 141 6 191 129 3 255 144 5 255 144 5 205 143 9 206 141 6 188 125 18 210 145 12 192 127 4 255 144 5 192 127 4 210 145 12 210 145 12 209 146 11 255 144 5 205 143 9 255 144 5 209 146 11 209 146 11 183 117 29 205 143 9 209 146 3 213 118 6 183 117 8 210 145 4 0 147 5 209 146 3 213 118 6 209 146 3 0 147 5 0 147 5 214 120 9 213 118 6 188 125 18 212 148 12 210 145 4 0 147 5 210 145 4 212 148 12 212 148 12 211 149 11 0 147 5 214 120 9 0 147 5 211 149 11 211 149 11 185 122 29 214 120 9 211 149 3 217 150 6 185 122 8 212 148 4 20 151 5 211 149 3 217 150 6 211 149 3 20 151 5 20 151 5 218 152 9 217 150 6 188 125 18 216 153 12 212 148 4 20 151 5 212 148 4 216 153 12 216 153 12 215 154 11 20 151 5 218 152 9 20 151 5 215 154 11 215 154 11 186 155 29 218 152 9 196 126 3 216 153 6 188 125 8 195 130 4 29 156 5 196 126 3 216 153 6 196 126 3 29 156 5 29 156 5 215 154 9 216 153 6 179 114 18 219 157 12 195 130 4 29 156 5 195 130 4 219 157 12 219 157 12 220 158 11 29 156 5 215 154 9 29 156 5 220 158 11 220 158 11 186 155 29 215 154 9 222 161 3 226 160 6 190 159 8 221 163 4 3 162 5 222 161 3 226 160 6 222 161 3 3 162 5 3 162 5 225 164 9 226 160 6 189 166 18 224 165 12 221 163 4 3 162 5 221 163 4 224 165 12 224 165 12 223 167 11 3 162 5 225 164 9 3 162 5 223 167 11 223 167 11 180 28 29 225 164 9 227 168 3 230 6 6 181 8 8 228 169 4 140 85 5 227 168 3 230 6 6 227 168 3 140 85 5 140 85 5 229 14 9 230 6 6 190 159 18 226 160 12 228 169 4 140 85 5 228 169 4 226 160 12 226 160 12 225 164 11 140 85 5 229 14 9 140 85 5 225 164 11 225 164 11 180 28 29 229 14 9 203 140 3 227 168 6 181 8 8 204 139 4 143 170 5 203 140 3 227 168 6 203 140 3 143 170 5 143 170 5 228 169 9 227 168 6 182 116 18 231 171 12 204 139 4 143 170 5 204 139 4 231 171 12 231 171 12 232 172 11 143 170 5 228 169 9 143 170 5 232 172 11 232 172 11 190 159 29 228 169 9 233 115 3 231 171 6 182 116 8 234 112 4 144 173 5 233 115 3 231 171 6 233 115 3 144 173 5 144 173 5 232 172 9 231 171 6 184 113 18 235 174 12 234 112 4 144 173 5 234 112 4 235 174 12 235 174 12 236 175 11 144 173 5 232 172 9 144 173 5 236 175 11 236 175 11 190 159 29 232 172 9 237 176 3 235 174 6 184 113 8 238 178 4 147 177 5 237 176 3 235 174 6 237 176 3 147 177 5 147 177 5 236 175 9 235 174 6 189 166 18 221 163 12 238 178 4 147 177 5 238 178 4 221 163 12 221 163 12 222 161 11 147 177 5 236 175 9 147 177 5 222 161 11 222 161 11 190 159 29 236 175 9 239 124 3 237 176 6 184 113 8 240 121 4 148 99 5 239 124 3 237 176 6 239 124 3 148 99 5 148 99 5 238 178 9 237 176 6 185 122 18 241 179 12 240 121 4 148 99 5 240 121 4 241 179 12 241 179 12 242 180 11 148 99 5 238 178 9 148 99 5 242 180 11 242 180 11 189 166 29 238 178 9 217 150 3 241 179 6 185 122 8 218 152 4 157 181 5 217 150 3 241 179 6 217 150 3 157 181 5 157 181 5 242 180 9 241 179 6 186 155 18 243 182 12 218 152 4 157 181 5 218 152 4 243 182 12 243 182 12 244 183 11 157 181 5 242 180 9 157 181 5 244 183 11 244 183 11 189 166 29 242 180 9 246 184 3 243 182 6 186 155 8 245 186 4 159 185 5 246 184 3 243 182 6 246 184 3 159 185 5 159 185 5 244 183 9 243 182 6 180 28 18 223 167 12 245 186 4 159 185 5 245 186 4 223 167 12 223 167 12 224 165 11 159 185 5 244 183 9 159 185 5 224 165 11 224 165 11 189 166 29 244 183 9 245 186 3 248 11 6 180 28 8 246 184 4 160 187 5 245 186 3 248 11 6 245 186 3 160 187 5 160 187 5 247 10 9 248 11 6 186 155 18 220 158 12 246 184 4 160 187 5 246 184 4 220 158 12 220 158 12 219 157 11 160 187 5 247 10 9 160 187 5 219 157 11 219 157 11 179 114 29 247 10 9
\n\t\t\t\t1 0 2 2 0 1 20 0 0 0 0 3 1 0 2 20 0 0 0 0 3 20 0 0 21 0 4 3 0 7 4 0 6 5 0 5 2 0 1 3 0 7 5 0 5 5 0 5 17 0 8 20 0 0 2 0 1 5 0 5 20 0 0 6 0 11 7 0 10 8 0 9 5 0 5 6 0 11 8 0 9 8 0 9 9 0 13 10 0 12 5 0 5 8 0 9 10 0 12 10 0 12 11 0 14 17 0 8 5 0 5 10 0 12 17 0 8 12 0 16 13 0 15 17 0 8 11 0 14 12 0 16 17 0 8 14 0 18 15 0 17 17 0 8 13 0 15 14 0 18 17 0 8 15 0 17 16 0 19 17 0 8 18 0 21 19 0 20 20 0 0 17 0 8 18 0 21 20 0 0 29 0 24 32 0 23 38 0 22 22 0 25 29 0 24 38 0 22 38 0 22 39 0 27 40 0 26 22 0 25 38 0 22 40 0 26 40 0 26 41 0 29 42 0 28 22 0 25 40 0 26 42 0 28 22 0 25 42 0 28 43 0 30 23 0 33 24 0 32 25 0 31 22 0 25 23 0 33 25 0 31 25 0 31 27 0 34 29 0 24 22 0 25 25 0 31 29 0 24 25 0 31 26 0 35 27 0 34 27 0 34 28 0 36 29 0 24 30 0 38 31 0 37 32 0 23 29 0 24 30 0 38 32 0 23 33 0 41 34 0 40 35 0 39 32 0 23 33 0 41 35 0 39 35 0 39 36 0 43 37 0 42 32 0 23 35 0 39 37 0 42 32 0 23 37 0 42 38 0 22 61 1 46 63 1 45 62 1 44 61 1 46 64 1 47 63 1 45 60 1 48 64 1 47 61 1 46 60 1 48 59 1 49 64 1 47 59 1 49 65 1 50 64 1 47 66 1 51 65 1 50 59 1 49 67 1 52 66 1 51 59 1 49 68 1 53 67 1 52 59 1 49 69 1 54 68 1 53 59 1 49 70 1 55 69 1 54 59 1 49 71 1 56 70 1 55 59 1 49 72 1 57 71 1 56 59 1 49 73 1 58 72 1 57 59 1 49 75 1 59 73 1 58 59 1 49 76 1 60 75 1 59 59 1 49 77 1 61 76 1 60 59 1 49 78 1 62 77 1 61 59 1 49 58 1 63 78 1 62 59 1 49 58 1 63 79 1 64 78 1 62 58 1 63 80 1 65 79 1 64 58 1 63 57 1 66 80 1 65 57 1 66 81 1 67 80 1 65 45 1 69 44 1 68 81 1 67 45 1 69 81 1 67 57 1 66 56 1 70 45 1 69 57 1 66 56 1 70 55 1 71 45 1 69 55 1 71 46 1 72 45 1 69 54 1 73 46 1 72 55 1 71 54 1 73 53 1 74 46 1 72 53 1 74 47 1 75 46 1 72 48 1 76 47 1 75 53 1 74 52 1 77 48 1 76 53 1 74 52 1 77 49 1 78 48 1 76 51 1 79 49 1 78 52 1 77 51 1 79 50 1 80 49 1 78 75 1 59 74 1 81 73 1 58
\n\t\t\t\t120 3 84 119 2 83 82 2 82 83 3 85 120 3 84 82 2 82 121 4 86 120 3 84 83 3 85 84 4 87 121 4 86 83 3 85 122 5 88 121 4 86 84 4 87 85 5 89 122 5 88 84 4 87 123 6 90 122 5 88 85 5 89 86 6 91 123 6 90 85 5 89 124 7 92 123 6 90 86 6 91 87 7 93 124 7 92 86 6 91 125 8 94 124 7 92 87 7 93 88 8 95 125 8 94 87 7 93 126 9 96 125 8 94 88 8 95 89 9 97 126 9 96 88 8 95 127 10 98 126 9 96 89 9 97 90 10 99 127 10 98 89 9 97 128 11 100 127 10 98 90 10 99 91 11 101 128 11 100 90 10 99 129 12 102 128 11 100 91 11 101 92 12 103 129 12 102 91 11 101 130 13 104 129 12 102 92 12 103 93 13 105 130 13 104 92 12 103 131 14 106 130 13 104 93 13 105 94 14 107 131 14 106 93 13 105 132 15 108 131 14 106 94 14 107 95 15 109 132 15 108 94 14 107 133 16 110 132 15 108 95 15 109 96 16 111 133 16 110 95 15 109 134 17 112 133 16 110 96 16 111 97 17 113 134 17 112 96 16 111 135 18 114 134 17 112 97 17 113 98 18 115 135 18 114 97 17 113 136 19 116 135 18 114 98 18 115 99 19 117 136 19 116 98 18 115 137 20 118 136 19 116 99 19 117 100 20 119 137 20 118 99 19 117 138 21 120 137 20 118 100 20 119 101 21 121 138 21 120 100 20 119 139 22 122 138 21 120 101 21 121 102 22 123 139 22 122 101 21 121 140 23 124 139 22 122 102 22 123 103 23 125 140 23 124 102 22 123 141 24 126 140 23 124 103 23 125 104 24 127 141 24 126 103 23 125 142 25 128 141 24 126 104 24 127 105 25 129 142 25 128 104 24 127 143 26 130 142 25 128 105 25 129 106 26 131 143 26 130 105 25 129 144 27 132 143 26 130 106 26 131 107 27 133 144 27 132 106 26 131 145 28 134 144 27 132 107 27 133 108 28 135 145 28 134 107 27 133 146 29 136 145 28 134 108 28 135 109 29 137 146 29 136 108 28 135 147 30 138 146 29 136 109 29 137 110 30 139 147 30 138 109 29 137 148 31 140 147 30 138 110 30 139 111 31 141 148 31 140 110 30 139 149 32 142 148 31 140 111 31 141 112 32 143 149 32 142 111 31 141 150 33 144 149 32 142 112 32 143 113 33 145 150 33 144 112 32 143 151 34 146 150 33 144 113 33 145 114 34 147 151 34 146 113 33 145 152 35 148 151 34 146 114 34 147 115 35 149 152 35 148 114 34 147 153 36 150 152 35 148 115 35 149 116 36 151 153 36 150 115 35 149 154 37 152 153 36 150 116 36 151 117 37 153 154 37 152 116 36 151 155 38 154 154 37 152 117 37 153 118 38 155 155 38 154 117 37 153 119 2 156 155 38 154 118 38 155 82 2 157 119 2 156 118 38 155 192 0 160 157 0 159 156 0 158 191 0 162 158 0 161 157 0 159 192 0 160 191 0 162 157 0 159 184 0 164 159 0 163 158 0 161 185 0 165 184 0 164 158 0 161 191 0 162 185 0 165 158 0 161 179 0 167 160 0 166 159 0 163 184 0 164 179 0 167 159 0 163 178 0 169 161 0 168 160 0 166 179 0 167 178 0 169 160 0 166 173 0 171 162 0 170 161 0 168 178 0 169 173 0 171 161 0 168 166 0 173 163 0 172 162 0 170 172 0 174 166 0 173 162 0 170 173 0 171 172 0 174 162 0 170 165 0 176 164 0 175 163 0 172 166 0 173 165 0 176 163 0 172 172 0 174 167 0 177 166 0 173 169 0 179 168 0 178 167 0 177 170 0 180 169 0 179 167 0 177 172 0 174 170 0 180 167 0 177 172 0 174 171 0 181 170 0 180 175 0 183 174 0 182 173 0 171 178 0 169 175 0 183 173 0 171 178 0 169 176 0 184 175 0 183 178 0 169 177 0 185 176 0 184 181 0 187 180 0 186 179 0 167 182 0 188 181 0 187 179 0 167 184 0 164 182 0 188 179 0 167 184 0 164 183 0 189 182 0 188 187 0 191 186 0 190 185 0 165 190 0 192 187 0 191 185 0 165 191 0 162 190 0 192 185 0 165 190 0 192 188 0 193 187 0 191 190 0 192 189 0 194 188 0 193 193 1 158 194 1 159 229 1 160 194 1 159 228 1 162 229 1 160 194 1 159 195 1 161 228 1 162 222 1 165 227 1 192 228 1 162 195 1 161 222 1 165 228 1 162 225 1 193 226 1 194 227 1 192 224 1 191 225 1 193 227 1 192 222 1 165 224 1 191 227 1 192 222 1 165 223 1 190 224 1 191 195 1 161 221 1 164 222 1 165 219 1 188 220 1 189 221 1 164 216 1 167 219 1 188 221 1 164 196 1 163 216 1 167 221 1 164 195 1 161 196 1 163 221 1 164 216 1 167 218 1 187 219 1 188 216 1 167 217 1 186 218 1 187 197 1 166 215 1 169 216 1 167 196 1 163 197 1 166 216 1 167 213 1 184 214 1 185 215 1 169 212 1 183 213 1 184 215 1 169 210 1 171 212 1 183 215 1 169 198 1 168 210 1 171 215 1 169 197 1 166 198 1 168 215 1 169 210 1 171 211 1 182 212 1 183 199 1 170 209 1 174 210 1 171 198 1 168 199 1 170 210 1 171 207 1 180 208 1 181 209 1 174 204 1 177 207 1 180 209 1 174 203 1 173 204 1 177 209 1 174 199 1 170 203 1 173 209 1 174 204 1 177 206 1 179 207 1 180 204 1 177 205 1 178 206 1 179 200 1 172 202 1 176 203 1 173 199 1 170 200 1 172 203 1 173 200 1 172 201 1 175 202 1 176
\n\t\t\t\t