From c9fb60ec6c7c7b1625e6da53268c7eaa21526d70 Mon Sep 17 00:00:00 2001 From: Zipeng WU Date: Mon, 15 Aug 2022 08:31:14 +0200 Subject: [PATCH] SONAR-17183 Fix SSF-207 --- build.gradle | 2 +- .../step/ExtractReportStep.java | 3 ++- .../step/ExtractReportStepTest.java | 16 ++++++++++++++++ .../step/ExtractReportStepTest/zip-bomb.zip | Bin 0 -> 4080882 bytes 4 files changed, 19 insertions(+), 2 deletions(-) create mode 100644 server/sonar-ce-task-projectanalysis/src/test/resources/org/sonar/ce/task/projectanalysis/step/ExtractReportStepTest/zip-bomb.zip diff --git a/build.gradle b/build.gradle index c576ccef91d..5d6e47a4502 100644 --- a/build.gradle +++ b/build.gradle @@ -179,7 +179,7 @@ subprojects { dependency 'org.sonarsource.kotlin:sonar-kotlin-plugin:2.10.0.1456' dependency 'org.sonarsource.slang:sonar-ruby-plugin:1.10.0.3710' dependency 'org.sonarsource.slang:sonar-scala-plugin:1.10.0.3710' - dependency 'org.sonarsource.api.plugin:sonar-plugin-api:9.9.0.229' + dependency 'org.sonarsource.api.plugin:sonar-plugin-api:9.10.0.269' dependency 'org.sonarsource.xml:sonar-xml-plugin:2.5.0.3376' dependency 'org.sonarsource.iac:sonar-iac-plugin:1.9.2.2279' dependency 'org.sonarsource.text:sonar-text-plugin:1.1.0.282' diff --git a/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/step/ExtractReportStep.java b/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/step/ExtractReportStep.java index 13662b05974..449e2e86d6c 100644 --- a/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/step/ExtractReportStep.java +++ b/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/step/ExtractReportStep.java @@ -45,6 +45,7 @@ import static org.sonar.core.util.FileUtils.humanReadableByteCountSI; */ public class ExtractReportStep implements ComputationStep { + static final long REPORT_SIZE_THRESHOLD_IN_BYTES = 2_000_000_000; private static final Logger LOGGER = Loggers.get(ExtractReportStep.class); private final DbClient dbClient; @@ -68,7 +69,7 @@ public class ExtractReportStep implements ComputationStep { File unzippedDir = tempFolder.newDir(); try (DbInputStream reportStream = opt.get(); InputStream zipStream = new BufferedInputStream(reportStream)) { - ZipUtils.unzip(zipStream, unzippedDir); + ZipUtils.unzip(zipStream, unzippedDir, REPORT_SIZE_THRESHOLD_IN_BYTES); } catch (IOException e) { throw new IllegalStateException("Fail to extract report " + task.getUuid() + " from database", e); } diff --git a/server/sonar-ce-task-projectanalysis/src/test/java/org/sonar/ce/task/projectanalysis/step/ExtractReportStepTest.java b/server/sonar-ce-task-projectanalysis/src/test/java/org/sonar/ce/task/projectanalysis/step/ExtractReportStepTest.java index 47038e99dc2..980a0c9dc05 100644 --- a/server/sonar-ce-task-projectanalysis/src/test/java/org/sonar/ce/task/projectanalysis/step/ExtractReportStepTest.java +++ b/server/sonar-ce-task-projectanalysis/src/test/java/org/sonar/ce/task/projectanalysis/step/ExtractReportStepTest.java @@ -22,6 +22,7 @@ package org.sonar.ce.task.projectanalysis.step; import java.io.File; import java.io.IOException; import java.io.InputStream; +import java.net.URL; import org.apache.commons.io.FileUtils; import org.junit.Rule; import org.junit.Test; @@ -91,6 +92,21 @@ public class ExtractReportStepTest { assertThat(logTester.logs(LoggerLevel.DEBUG)).anyMatch(log -> log.matches("Analysis report is \\d+ bytes uncompressed")); } + @Test + public void unzip_report_should_fail_if_unzip_size_exceed_threshold() throws Exception { + logTester.setLevel(LoggerLevel.DEBUG); + URL zipBombFile = getClass().getResource("/org/sonar/ce/task/projectanalysis/step/ExtractReportStepTest/zip-bomb.zip"); + try (InputStream input = zipBombFile.openStream()) { + dbTester.getDbClient().ceTaskInputDao().insert(dbTester.getSession(), TASK_UUID, input); + } + dbTester.getSession().commit(); + dbTester.getSession().close(); + + assertThatThrownBy(() -> underTest.execute(new TestComputationStepContext())) + .isInstanceOf(IllegalStateException.class) + .hasMessage("Decompression failed because unzipped size reached threshold: 2000000000 bytes"); + } + private File generateReport() throws IOException { File zipDir = tempFolder.newDir(); File metadataFile = new File(zipDir, "metadata.pb"); diff --git a/server/sonar-ce-task-projectanalysis/src/test/resources/org/sonar/ce/task/projectanalysis/step/ExtractReportStepTest/zip-bomb.zip b/server/sonar-ce-task-projectanalysis/src/test/resources/org/sonar/ce/task/projectanalysis/step/ExtractReportStepTest/zip-bomb.zip new file mode 100644 index 0000000000000000000000000000000000000000..d06da2cf224e44371d1a6357bc220dc138f738e1 GIT binary patch literal 4080882 zcmeF)zfLP(mnPr>TgdW}W*P~TOyYnTedm1r=j)&)PeOu_96-uwBvNNaf~bv9i;Rp* zAm9Rkn2eCjICF|1>cG)ho+>1}wtwOZ_IfI)TALHS&vI0j-_t*AGp%YSPv8Hm;D7(;poxP30RjXF5FkK+009C72oT6#Kw&`kD;AId0RjXF5FkK+009C7 z2&@Yz3|RMYB0zuu0RjXF5FkK+009EI3n&c8eZ%q*AV7cs0RjXF5FkK+0D*M@g#qgx zP6P-LAV7cs0RjXF5FkJxcL9X~xo=oL0t5&UAV7cs0RjXF5Fqdu0fhm70dXWifB*pk z1PBlyK!5-N0+|aa49I-J;t?P~fB*pk1PBlyK!5;&zX&J{_zQ?50RjXF5FkK+009C7 z2oT6zKw&`U3l@(60RjXF5FkK+009C72>ew*VZdKSoCy#hK!5-N0t5&UAV7dX-U12( z^4_m>1PBlyK!5-N0t5&UAVA=+0ty5ED&kCl009C72oNAZfB*pk1o9TRn@vZ}q9}TA zi}AeGDJK^J0t5&UAV7cs0RjZF6FA-MA2ymhWv*6nbkjb0ntVR*-ENfU-d4N3pPdf| zm%sOi7sIcYt1A7ddq4l!eW?D;MSuVS0t5&UAV7cs0RjXFWGyh7TsNwh1Vwi-KIrHD z?XYwN2oNAZfB*pk1PBlyK!89gpjOStfB*pk1PBlyK!5-N0t5)e5>TraYv0lmAV7cs z0RjXF5FkK+0D;bI+WY<$#Ova5`~}060RjXF z5FkK+009C72oOjG6b7UkWV5FkK+009C72oNBUzktGk{C6xN0RjXF5FkK+009C7 z2oOjG6b7UkWV5FkK+009C72oN9;KtN$YfF+AafB*pk1PBlyK!5-N0t6BPg#ihM zkpKY#1PBlyK!5-N0t5&I5KtHpV96p9AV7cs0RjXF5FkK+0D(k6VL*amBtU=w0RjXF z5FkK+009CK1QZ5D*s_cS2oNAZfB*pk1PBlyK%f>-7*Jc72oNAZfB*pk1PBlyK!895 z0fhk(wk#t70t5&UAV7cs0RjXF5U2$d2GkZN0t5&UAV7cs0RjXF5FijjKw&_LH490A z009C72oNAZfB*pk1XcnH16C9U0t5&UAV7cs0RjXF5FijjKw&_LH490A009C72oNAZ zfB*pk1XcnH16C9U0t5&UAV7cs0RjXF5FijkKw&_PJxfV|009C72oNAZfB*pk1eO8{ z1C|n=1PBlyK!5-N0t5&UAV467fWm+ndzO*_0RjXF5FkK+009C72rLEeX46r#D2m?O zVmxnk%E?85009C72oNAZfB=E)1Wq^mhmGb=nX6SC-Ly}hCZErHw;ScTx79B1XXk^# z<)8iG#qjIps!BiV-p@aFAF6+I5gTEPeqAV7cs0RjXF5FkK+z>flI)qZ60M*;*0 z5FkK+009C72oNBUtw3is?S20W;&t)3eVlDf!3Yo_K!5-N0t5&UAV7csfu+E^!hj`( zCjkNk2oNAZfB*pk1PBlaA)qiI#F~X9K!5-N0t5&UAV7cs0Rk%lg#jxH0|5dA2oNAZ zfB*pk1PBlaA)qiI#F~X9K!5-N0t5&UAV7cs0Rpvv!hqVsM1TMR0t5&UAV7cs0RjXf z2q+AQuw@wu5FkK+009C72oNAZfIuyvFrc1)0RjXF5FkK+009C72oMM$pfDi7l0_syfB*pk1PBlyK!5-N0;zz) zfK#`{Zfz`Mh_#QJ#BS z?eczhJ{Vm7eSdf{{Cc^n(vQ0L^N-z!>fc-h2oNAZfB*pk1PBlyK!8Bj0;9=wqk2hD zbQj};e)eAw3rK(f0RjXF5FkK+009C72&h%_86ZG_009C72oNAZfB*pku>{nr#oD*D z1PBlyK!5-N0t5&UAV8oqoA$nc1@XFg+&<<(fB*pk1PBlyK!5-N0t5(TFYvA~Ap0E) zNPqwV0t5&UAV7cs0RjY40fhmnhM52X0t5&UAV7cs0RjXF9{$ZoJQ|4+FM>p-0r^)B@-t9(t?rpWp z``P(maQV;s!;9h9%T<+r)V-g7>^@Zg<|06V009C72oNAZfB*pk1hN(wO|Bc&OM;@i z7$5YP-=lgGAV7cs0RjXF5FkK+009Eo3aC}fcC~^LAV7cs0RjXF5FkK+0D&I`)T;f+ z;*SIf5FkK+009C72oNAZAX|aXY})(&6~yb}ar-#in1T@?K!5-N0t5&UAV7cs0Rl^b zcZC5<3QqzA2oNAZfB*pk1PBly5JEs;)7CWWQno2@oJafB*pk1PBlyK!CuSfWm+^4hI4R2oNAZfB*pk1PBly zkiEd&Y&vQdMbUd(jOVRRIk^ZBAV7cs0RjXF5Fn79!0BfHu+iKpbG3@2oA$}mE2oNAZfB*pk1PBlykiEdW z!hq~|EFb{_1PBlyK!5-N0t5&UNCgxIq#9-d1PBlyK!5-N0t5&UAdtU+!hrmDEFl2` z1PBlyK!5-N0t5&UNCgxIq#9-d1PBlyK!5-N0t5&UAP_)6VL*T-i%5U~0RjXF5FkK+ z009C75&?w)35JmX0RjXF5FkK+009C72m}yN7!Y8|A`&1#fB*pk1PBlyK!5;&L_lFc zf?*^;fB*pk1PBlyK!5-N0uclh21MAhj06Y}AV7cs0RjXF5FkLH7El;aTbKwCAV7cs z0RjXF5FkK+Km-AW0TH$=BLM;g2oNAZfB*pk1PBnQ1r!F<7A67&2oNAZfB*pk1PBly z5JEsO|~EGaw*5FkK+009C72oNAZfItWVg#jVfEF=K}1PBlyK!5-N0t5&USP3W$ zSWy@V5FkK+009C72oNAZfItWVg#jVfEF=K}1PBlyK!5-N0t5&Us09=T)D|WJ1PBly zK!5-N0t5&UAP_-7VL*f}%SeC#0RjXF5FkK+009C7Y5|1-wS|cQ0RjXF5FkK+009C7 z2t*K27!YC0G7=y_fB*pk1PBlyK!5;&L_lFcf?*^;fB*pk1PBlyK!5-N0s#aR1_W5L zhy(}_AV7cs0RjXF5FkJx5l|SAU>FGyAV7cs0RjXF5FkK+KmY-S0RfgQA^`#f2oNAZ zfB*pk1PBmF1r!FP8fF3n2oNAZfB*pk1PBlykiUS!fc$qXAprse2oNAZfB*pk1PBmF z1r!FP8fF3n2oNAZfB*pk1PBlykiUS!fc$qXAprse2oNAZfB*pk1PBmV6Hpki#^FGK z009C72oNAZfB*pk1hN-U7?Ayn1tdU#009C72oNAZfB*pkYXS-b);Jsp5FkK+009C7 z2oNAZfI#*FceClJSrkR@Z84s=I_2adK!5-N0t5&UAV7dXb^@oH{li9cr_9wVj&9l~ zPm|B*z1xlQ+}moG_p|fC;PT)0hZn=Im#ZrMsCz&E*nOz}%|(C!0RjXF5FkK+009C7 z2xKiVnp`)kmjp$3F+S*L{{^vt1PBlyK!5-N0t5&UAV7eCS~Z^m0t5&UAV7cs0RjXF z5FijsK&@J=eM?J#009C72oNAZfB*pk1Uj>6@B3E}uZzd+V;%$u5FkK+009C72oNAZ zfI#*F?+OF5-?4xM2oNAZfB*pk1PBlyKp+)R7?5h12@oJafB*pk1PBlyK!8C00ty52 z-?4-Q2oNAZfB*pk1PBlyKp+)R7?5h12@oJafB*pk1PBlyK!8910fhkpmMkIx0t5&U zAV7cs0RjXF5J&_R1|%3p0t5&UAV7cs0RjXF5FijhKw&_DC5uRa009C72oNAZfB*pk z1QG#-0SShY009C72oNAZfB*pk1PDYBP#6$l%Q6xmK!5-N0t5&UAV7csfm%ReKy6_n zK!5-N0t5&UAV7cs0Rj;O6b3}tvWx@>5FkK+009C72oNAZpcYUVP+OP?5FkK+009C7 z2oNAZfItWVg#jVfEF=K}1PBlyK!5-N0t5&USP3W$SWy@V5FkK+009C72oNAZfItWV zg#jVfEF=K}1PBlyK!5-N0t5&USP3W$SWy@V5FkK+009C72oNAZfItiZg#j`4EF}Q~ z1PBlyK!5-N0t5&USPCc%SW0*jAV7cs0RjXF5FkK+0D%|+3Ik&7SxN!~2oNAZfB*pk z1PBlyuoSqPO-Ie5D0**;@x0Y3Cl>(%1PBlyK!5-N0tB)XINj_YHkvzSu2yk$(>{5c zd_M2pZj|TVR=d2Poeu_=|JWa148LBks`R7o{rqG1q53x$0RjXF5FkK+009C72oNBU zwZLd{-Kbs?6y3%6puhYc)sp}L0t5&UAV7cs0RjXF5Xe?Qty;FL6^sA@0t5&UAV7cs z0RjXF{3xJS?MD`WBtU=w0RjXF5FkK+009Eo3Up@E-uJH{UKfws$Jxddi~s=w1PBly zK!5-N0t5&USPHx=3|LZl5+Fc;009C72oNAZfB=CI0ty2{tXW6`1PBlyK!5-N0t5&U zAg~fp7_g!+5FkK+009C72oNAZfB=CI0ty2{tXW6`1PBlyK!5-N0t5&UAW#b^45%$k z1PBlyK!5-N0t5&UAV463fWm+XTb7Xk0RjXF5FkK+009C72-E@!18NHs0RjXF5FkK+ z009C72oQ)MpfDi9mSrSBfB*pk1PBlyK!5-N0*QdafCR%xfB*pk1PBlyK!5-N0t5mG zC=3X&WDyAvAV7cs0RjXF5FkK+Kq82oNAZfB*pk z1PBlykP0XaNHxp^2oNAZfB*pk1PBlyKp=ksg#r2RSV95>2oNAZfB*pk1PBlyuqL1| zV2#6p009C72oNAZfB*pk1PEj=pfDi&6$?m!009C72oNAZfB*pk1l9x;2CQ*75FkK+ z009C72oNAZfB=E)1@30kQL`wD-rHh4Z*|JaMSuVS0t5&UAV7csf$RiMH~WW;=1!Tb zRUF;4Po5^9&wIBU<+-=jF7IdOgTdv$?+-7AUoTfx`ce0O{;~T|{hNyb0RjXF5FkK+ z009C72oT6xU^KaIR4)mN?qYn<&;AQy0SOQwK!5-N0t5&UAV7cs0kvvA0|W>VAV7cs z0RjXF5FkJxmVjEdSo@Zi009C72oNAZfB*pk1PF9y)86;5AYK=b+s8Zz5FkK+009C7 z2oNAZfB=E)1>O|~WWQqp2@oJafB*pk1PBlyK!89hpfDiSFcTm^fB*pk1PBlyK!5;& z`~?&S{&_z1PBlyK!5-N0t5&UAg~lr7_gM^BtU=w0RjXF5FkK+009Cq1QZ6u*t3)b2oNAZ zfB*pk1PBlyKwv3wH=B-{MN#zL7UOxVQ%)`d1PBlyK!5-N0t5(TCvdviKWsF2%3Q7D z=%#)0H2HkqyWJ?yy{%v6{p@@&xcvRM{o%#%>*cD7KkDAkKXxD5)$AfbfB*pk1PBly zK!5-N0t9jv7)`Dl)mwt1yBHtzmtUlM5+Fc;009C72oNAZfB*pk*$U`Y%XYPb5g)gOA1c{1PBlyK!5-N0t5&UAP_=8VL*sA3rTFGyAV7cs0RjXF z5FkK+KmY-S0RfgQA^`#f2oNAZfB*pk1PBmF1QZ4&7)AmF2oNAZfB*pk1PBly5I{g- zK!7ESNPqwV0t5&UAV7cs0RjY40fhmnhM52X0t5&UAV7cs0RjXF*cD7KkDAkKXxD5)$Afb zfB*pk1PBlyK!5-N0t9jv7)`Dl)mwt1yBHtzv;T%zKmr5^5FkK+009C72oNAZK(Ct5 z009C72oNAZfB*pk1PBm_C7@R=*1n}BK!5-N0t5&UAV7cs0Ro-bwD)g+3#3D0t5&UAV7cs0RjXF5Fn5WC=5t7%mfG!AV7cs z0RjXF5FkJxe*uL7`R`al0t5&UAV7cs0RjXF5Fn5WC=5t7%mfG!AV7cs0RjXF5FkJx zfPlh)0818;009C72oNAZfB*pk1PCMo3Ih@hBLM;g2oNAZfB*pk1PBlaAfPZHz>-BI zK!5-N0t5&UAV7cs0RoAD!hi(BNPqwV0t5&UAV7cs0RjXf2q+AQuw@wu5FkK+009C7 z2oNAZfIuyvFrcOy(K8Ri}68!`9-QH0RjXF5FkK+009C72oNBUt$<#& zY*#B70RjXF5FkK+009C72oU&DK(E@5EdEG<009C72oNAZfB*pk1hN(A%%;8XA3?k> z9=DIPjVTxb0t5&UAV7cs0RjXF5FoG=cvl#(r0^s_fB*pk1PBlyK!5-N0wDwx2839% zkOT-2AV7cs0RjXF5FkKcC7>{1MPVR7fB*pk1PBlyK!5-N0wDwx2839%kOT-2AV7cs z0RjXF5FkLH7El;aTbKwCAV7cs0RjXF5FkK+Km-AW0TH$=BLM;g2oNAZfB*pk1PBnQ z1r!F<7A67&2oNAZfB*pk1PBly5J5m;K!h#JNPqwV0t5&UAV7cs0RjXP0fhkxhLHdP z0t5&UAV7cs0RjXF1Q1Xd5Maq75+Fc;009C72oNAZfB=C+Kw&_FVI)9+009C72oNAZ zfB*pk0R$8V1X!|&1PBlyK!5-N0t5&UAV44$P#BPEm-BIK!5-N0t5&UAV7cs0RoAD!hi(BNPqwV0t5&UAV7cs0RjX9 z2q+8)uw)Sl5FkK+009C72oNAZfIuRkFd)G&5+Fc;009C72oNAZfB=CA0ty2nY*|JE z1PBlyK!5-N0t5&UAW#b^45%$k1PBlyK!5-N0t5&UAV463fWm+XTb7Xk0RjXF5FkK+ z009C72-E@!18NHs0RjXF5FkK+009C72oMM%pfDiBnuR1lfB*pk1PBlyK!5-N0xJQ9 z0V@gv0RjXF5FkK+009C72oMM%pfDiBnuR1lfB*pk1PBlyK!5-N0xJQ90V@gv0RjXF z5FkK+009C72oQ)NpfDiDo~0x}fB*pk1PBlyK!5-N0!smf0ZR!_0t5&UAV7cs0RjXF z5FijkKw&_PJxfV|009C72oNAZfB*pk1eOAKv+1Z=6h-fCF`lVqjfB*pk1PBly zK!8AY0;ik(!$xzb%+)H6ZrUeLlh5b9+l}(v+xk`B&&~&f%isUJKfD-zySBnq3445FkK+009C72oNAZfI!XyqseundP`7r7vqEe@{3eY0t5&UAV7cs0RjXF z5FkJxTLHal*{)VF0t5&UAV7cs0RjXF5FqfQfL^s9S^SXz0RjXF5FkK+009C72xKeJ znN54&KZ1B&JZ>Ln8&fa>1PBlyK!5-N0t5&UAV6R#@UAdmN#RL=009C72oNAZfB*pk z1VRWX3<$AiAqfy5K!5-N0t5&UAV7e?NT>k!-{o%#% z>*cD7KkDAkKXxD5)$AfbfB*pk1PBlyK!5-N0t9jv7)`Dl)mwt1yBHtzv;T%zKmr5^ z5FkK+009C72oNAZK(Ct5009C72oNAZfB*pk1PBm_C7@R=*1n}BK!5-N0t5&UAV7cs z0Ro-bwD)g+3#3D0t5&UAV7cs0RjXF z5Fn5WC=5t7%mfG!AV7cs0RjXF5FkJxe*uL7`R`al0t5&UAV7cs0RjXF5Fn5WC=5t7 z%mfG!AV7cs0RjXF5FkJxfPlh)0818;009C72oNAZfB*pk1PCMo3Ih@hBLM;g2oNAZ zfB*pk1PBlaAfPZHz>-BIK!5-N0t5&UAV7cs0RoAD!hi(BNPqwV0t5&UAV7cs0RjXf z2q+AQuw@wu5FkK+009C72oNAZfIuyvFrc z^>S6kA9e5NAG;6jYIYGIK!5-N0t5&UAV7cs0RlM-j3(EO>McRhU5pR<%P&$r2@oJa zfB*pk1PBlyK!5;&Yz6eHWxHCz2oNAZfB*pk1PBlyK!CuH0(#YcWbsD=1PBlyK!5-N z0t5&UAdsyVAV7cs0RjXF5FkJxmVjQhSo@Zi009C7 z2oNAZfB*pk1PF9y)86-wAYK=b+s8Zz5FkK+009C72oNAZfB=E)1>O|~WWQqp2@oJa zfB*pk1PBlyK!89hpfDiSFcTm^fB*pk1PBlyK!5;&`~?&S{&_z1PBlyK!5-N0t5&UAg~lr z7_gM^BtU=w0RjXF5FkK+009Cq1QZ6u*t3)b2oNAZfB*pk1PBlyKwv3wH=B-{MN#zL z7UOxVQ%)`d1PBlyK!5-N0t5(TCvdviKWsF2%3Q7D=%#)0H2HkqyWJ?yy{%v6{p@@& zxcvQ({o%#%>*cD7KkDAkKXxD5)$AfbfB*pk1PBlyK!5-N0t9jv7)`Dl)mwt1yBHtz zmtUlM5+Fc;009C72oNAZfB*pk*$U`Y%XYPb5g)g zOA1c{1PBlyK!5-N0t5&UAP_=8VL*sA3rTFGyAV7cs0RjXF5FkK+KmY-S0RfgQA^`#f2oNAZ zfB*pk1PBmF1QZ4&7)AmF2oNAZfB*pk1PBly5I{g-K!7ESNPqwV0t5&UAV7cs0RjY4 z0fhmnhM52X0t5&UAV7cs0RjXF2oNAZfB*pk1PBlyKwu@HFknStAV7cs0RjXF5FkK+009Ca1QZ5@ShJ7> z2oNAZfB*pk1PBlyKwu@HFknStAV7cs0RjXF5FkK+009Cq1QZ6u*t3)b2oNAZfB*pk z1PBlyKwv4LFkmU+Nq_(W0t5&UAV7cs0RjYK2q+AQv1cg>5FkK+009C72oNAZfWT7V zZZ;h?i=ybgEynX!r<_~_2oNAZfB*pk1PBnwPT+L2f7od5l(|~P(M|j0Y4Z8Jce_!Z zdt1NC``P(maQWwN`@@Uj*UMEEf7HF7f9yWAtJy_>009C72oNAZfB*pk1PJ6TFq&L9 zs<#A1cQHQbFTY6jBtU=w0RjXF5FkK+009C7vK7#)mhEZjj9{$ZoJQ|4+FM>p-0 zr^)B@-t9(t?rr@l?`P+O!R4Rd`@@Uj*UMEEf7HF7f9yWAtJy_>009C72oNAZfB*pk z1PJ6TFq&L9s<#A1cQHQbXa5bcfCLB-AV7cs0RjXF5FkK+fL=A90RjXF5FkK+009C7 z2oN9;OF*w$tbI#MfB*pk1PBlyK!5-N0t7m-7*Jc72oNAZfB*pk z1PBlyK!8990fhk})+{6e0t5&UAV7cs0RjXF5LgK)3|LVZ2oNAZfB*pk1PBlyK!899 z0fhk})+{6e0t5&UAV7cs0RjXF5LgK)3|LVZ2oNAZfB*pk1PBlyK!89D0fhlE_ADg< z0t5&UAV7cs0RjXF5LgN*3|LBd5+Fc;009C72oNAZfB=CQ0ty3S>{&_z1PBlyK!5-N z0t5&UAg~m;n@vZ}q9}TAi}AeGDJK^J0t5&UAV7cs0RjZF6FA-MA2ymhWv*6nbkjb0 zntVR*-ENfU-qx@3es(?>T>km9KfD-zySBnq3445FkK+009C72oNAZ zfI!XyqseundP`7r7vqEe@{3eY0t5&UAV7cs0RjXF5FkJxTLHal*{)VF0t5&UAV7cs z0RjXF5FqfQfL^s9S^SXz0RjXF5FkK+009C72xKeJnN54&KZ1B&JZ>Ln8&fa>1PBly zK!5-N0t5&UAV6R#@UAdmN#RL=009C72oNAZfB*pk1VRWX3<$AiAqfy5K!5-N0t5&U zAV7e?NT>km{{_tY>^>S6kA9e5NAG;6jYIYGIK!5-N z0t5&UAV7cs0RlM-j3(EO>McRhU5pR<*?&VUAOQjd2oNAZfB*pk1PBlypjXXjfB*pk z1PBlyK!5-N0t5)e640v_Yv0lmAV7cs0RjXF5FkK+0D;bI+WY~}060RjXF5FkK+009C72oOjG6b7UkWV5FkK+009C7 z2oNBUzktGk{C6xN0RjXF5FkK+009C72oOjG6b7UkWV5FkK+009C72oN9;KtN$Y zfF+AafB*pk1PBlyK!5-N0t6BPg#ihMkpKY#1PBlyK!5-N0t5&I5KtHpV96p9AV7cs z0RjXF5FkK+0D(k6VL*amBtU=w0RjXF5FkK+009CK1QZ5D*s_cS2oNAZfB*pk1PBly zK%f>-7*Jc72oNAZfB*pk1PBlyK!8950fhk(wk#t70t5&UAV7cs0RjXF5U2$d2GkZN z0t5&UAV7cs0RjXF5FijjKw&_LH490A009C72oNAZfB*pk1XcnH16C9U0t5&UAV7cs z0RjXF5FijjKw&_LH490A009C72oNAZfB*pk1XcnH16C9U0t5&UAV7cs0RjXF5Fijk zKw&_PJxfV|009C72oNAZfB*pk1eO8{1C|n=1PBlyK!5-N0t5&UAV467fWm+ndzO*_ z0RjXF5FkK+009C72rLEeX46r#D2m?OVmxnk%E?85009C72oNAZfB=E)1Wq^mhmGb= znX6SC-Ly}hCZErHw;ScTxAm*MpPdf|mw*0we|Rzcdbz6NkGl8skKKoMHM009C72oNAZfB*pk1PJ6TFq&L9s<#A1cQHQbXa5bcfCLB-AV7cs0RjXF5FkK+ zfL=A90RjXF5FkK+009C72oN9;OF*w$tbI#MfB*pk1PBlyK!5-N0t7m-7*Jc72oNAZfB*pk1PBlyK!8990fhk})+{6e0t5&UAV7cs0RjXF5LgK)3|LVZ z2oNAZfB*pk1PBlyK!8990fhk})+{6e0t5&UAV7cs0RjXF5LgK)3|LVZ2oNAZfB*pk z1PBlyK!89D0fhlE_ADg<0t5&UAV7cs0RjXF5LgN*3|LBd5+Fc;009C72oNAZfB=CQ z0ty3S>{&_z1PBlyK!5-N0t5&UAg~m;n@vZ}q9}TAi}AeGDJK^J0t5&UAV7cs0RjZF z6FA-MA2ymhWv*6nbkjb0ntVR*-ENfU-qx@3es(?>T>kmj{o%#%>*cD7KkDAkKXxD5 z)$AfbfB*pk1PBlyK!5-N0t9jv7)`Dl)mwt1yBHtzmtUlM5+Fc;009C72oNAZfB*pk z*$U`Y%XYPb5g)gOA1c{1PBlyK!5-N0t5&UAP_=8 zVL*sA3rTFGyAV7cs0RjXF5FkK+KmY-S0RfgQA^`#f2oNAZfB*pk1PBmF1QZ4&7)AmF2oNAZ zfB*pk1PBly5I{g-K!7ESNPqwV0t5&UAV7cs0RjY40fhmnhM52X0t5&UAV7cs0RjXF z2oNAZfB*pk1PBly zKwu@HFknStAV7cs0RjXF5FkK+009Ca1QZ5@ShJ7>2oNAZfB*pk1PBlyKwu@HFknSt zAV7cs0RjXF5FkK+009Cq1QZ6u*t3)b2oNAZfB*pk1PBlyKwv4LFkmU+Nq_(W0t5&U zAV7cs0RjYK2q+AQv1cg>5FkK+009C72oNAZfWT7VZZ;h?i=ybgEynX!r<_~_2oNAZ zfB*pk1PBnwPT+L2f7od5l(|~P(M|j0Y4Z8Jce_!Zdt1NC``P(maQWvS`@@Uj*UMEE zf7HF7f9yWAtJy_>009C72oNAZfB*pk1PJ6TFq&L9s<#A1cQHQbFTY6jBtU=w0RjXF z5FkK+009C7vK7#)mhEZjj9{$ZoJQ|4+FM>p-0r^)B@-t9(t?rr@l?`P+O!R4QS z-ydEKzh17Y_@nOq{A2f_UCk~61PBlyK!5-N0t5&UAV45zfzjl;QN1N7x{L8aKl^Wp z1tdU#009C72oNAZfB*pk1oW!;3=kkdfB*pk1PBlyK!5;&SOR+0V(nX60t5&UAV7cs z0RjXF5FpT*O?%%zf_Pm#ZXfd?K!5-N0t5&UAV7cs0RjZF7kF0~ko}GYBtU=w0RjXF z5FkK+009E2fWm-O!%Tnx0RjXF5FkK+009C7@)uATkpGS)BtU=w0RjXF5FkK+009E2 zfWm-O!%Tnx0RjXF5FkK+009C70thG!2(V-k2@oJafB*pk1PBlyK!89ZpfDi8FcKg@ zfB*pk1PBlyK!5;&00IgF0xVfX0t5&UAV7cs0RjXF5Fn5UC=5t2j06Y}AV7cs0RjXF z5FkJxf`Gz+2wRqs009C72oNAZfB*pk1PIgu3Il2j69EDQ2oNAZfB*pk1PBm_AfPZH z!j@$uK!5-N0t5&UAV7cs0Rpvv!hqVsM1TMR0t5&UAV7cs0RjX<2q+8)v1TC&5FkK+ z009C72oNAZfWS&XVZe&QK!5-N0t5&UAV7cs0RjX<2q+8)v1TC&5FkK+009C72oNAZ zfWS&XVZe&QK!5-N0t5&UAV7cs0RjYK2q+AQv1cg>5FkK+009C72oNAZfWT5fVZc(t zlK=q%1PBlyK!5-N0t5)e5KtHpW6x3&AV7cs0RjXF5FkK+0D+~z-E2B)7Ddr}Ta4$e zPC2;<5FkK+009C72oNBUoxtg4|FF^ADRZ@oqnq~0)8zAc?{=d+_qKkO_p|fC;PUT( z+aF#Gzh17Y_@nOq{A2f_UCk~61PBlyK!5-N0t5&UAV45zfzjl;QN1N7x{L8afB8kK zCjkNk2oNAZfB*pk1PBlykgb4TwQN@_7y$wV2oNAZfB*pk1PBoLQ9!TSk1YO3fB*pk z1PBlyK!5-N0tB)Z=**_Q?;kh*>1M=Uogail>AV7cs0RjXF5FkJx6;K$EYM2QSAV7cs z0RjXF5FkK+K>h*>1M=Uogail>AV7cs0RjXF5FkKcO+aD58ixY`0t5&UAV7cs0RjXF z5XfFYVLFNqx5aqg>Xeg<009C72oNAZfB*pk*$JF(_75A)oibOeIJ#+{JWW2I_ii`Jb8qWc zc|SWJ3@-ovdw+N_{Cc^n;*Yxb^N-z!b~U>Q5FkK+009C72oNAZfB=D<1xAzWM)j7U z=q|jZ!L*FB)+bhR!*N7~?l>lJ653sJTAR>nk*$@4&P0etjMg8v33HC=8fT z7zhv`K!5-N0t5&UAV7dX5&{YXl325l1PBlyK!5-N0t5&UAV8oHP#92HmOa0#o>hj0RjXF5FkK+ z009C72t+S%)a!Q2S(Y`<2Iu`sEuTCD2oNAZfB*pk1PBm_PGD=kxn3$S=ea7`#zA%S z_~P7)H&{7(IT|H-Wf)#2fB*pk1PBly zK!5-N0%-~8RZDB%(h?v*fB*pk1PBlyK!5;&TCdx<`Xh+b!NaAyJO~gVK!5-N0t5&U zAV7csf#?MuD-4K!#{v={K!5-N0t5&UAV7csflxqUK&W9RK!5-N0t5&UAV7cs0Rr(0 zC=7^y#}X1CK!5-N0t5&UAV7csflxqUK&W9RK!5-N0t5&UAV7cs0RjmKC=5to$s!UU zK!5-N0t5&UAV7csfj~fEK!9N+K!5-N0t5&UAV7cs0RjmKC=5to$s!UUK!5-N0t5&U zAV7csfj~fEK!9N+K!5-N0t5&UAV7cs0RkxqC=5tp%Q6xmK!5-N0t5&UAV7csfkHrG zKw)7bK!5-N0t5&UAV7cs0RkxqC=5tp%Q6xmK!5-N0t5&UAV7csfkHrGKw)7bK!5-N z0t5&UAV7cs0Rl+~C=5tq%|a3&K!5-N0t5&UAV7csfr)^^fC+_x009C72oNAZfB*pk z1PCM{pfDhbH490A009C72oNAZfB*pk1SSFs111y(0t5&UAV7cs0RjXF5Fn6-fWm+@ z_ADg<0t5&UAV7cs0RjXF5Eu(63>ZuJBtU=w0RjXF5FkK+009DN2q+9lW6x3&AV7cs z0RjXF5FkK+0D-Zebwf5FtTW#;QpFY|j#_!bc_n+K)P#w-50t5&UAV7cs z0RjXF5FkJxW`WMdz0&Zv1X+D>ey2J9BGo4W0t5&UAV7cs0RjXF5Fik(fL^s|S1T9+ z0t5&UAV7cs0RjXF5O}75UbSbk_(uW+2oNAZfB*pk1PBly5UoJ1*KJ(=5ya`>;nLk` zV+uxq009C72oNAZfB*pk1PF`;9xDtOQ}`r6fB*pk1PBlyK!5-N0!auc3`k0!O`Wr<`S3<7{x=uhjC%Lx2DQ0t5&UAV7cs zf#?Lb=9}xK@^YT5l5HGRH;*qaPgV}+^7qEVV*Yb`r`6h9dwsRN+kX0Je;B`0zu$jy z>p^umdk7F9K!5-N0t5&UAV7csftUq47xzlT-x6f?!TFtL^xqH*NPqwV0t5&UAV7cs z0RjXF=v8wE2oNAZfB*pk1PBlyK!8A60(#Zb+PAa>2oNAZfB*pk1PBlyK%my^Hm?2% z;&kwE=`Iff1PBlyK!5-N0t5&UAV45`fyW91qTjKA1PBlyK!5-N0t5&UAV44#P#6$u zmX%AdNjsNq_(W0t5&UAV7cs0RjZZ0ty4h5a-{YovLJOl_3AV7cs z0RjXF5Qt7-YreT&Dlg}`D%r+Cb@TY*@?_<3E`M(2oNAZfB*pk1PBlyKwu)EFknJqAV7cs0RjXF5FkK+009C? z2q+9lV$DJlAV7cs0RjXF5FkK+0D(e4VL)MFB0zuu0RjXF5FkK+009Ci2q+9lVaqZS zAV7cs0RjXF5FkK+0D(e4VL)MFB0zuu0RjXF5FkK+009Ci2q+9lVaqZSAV7cs0RjXF z5FkK+0D(Y2VL*UkBtU=w0RjXF5FkK+009CC2q+9lV96p9AV7cs0RjXF5FkK+0D(Y2 zVL*UkBtU=w0RjXF5FkK+009CC2q+9lV96p9AV7cs0RjXF5FkK+0D(|IVL+&1CP07y z0RjXF5FkK+009E=3n&bTf5#FMAV7cs0RjXF5FkK+0D(|IVL+&1CP07y0RjXF5FkK+ z009E=3n&bTf5#FMAV7cs0RjXF5FkK+0D&n1g#l9>UI-8%K!5-N0t5&UAV7dX^a2V4 zqF=Fq1PBlyK!5-N0t5&UAV6SBKw-cXhZh0_2oNAZfB*pk1PBly5WT=ruiGhSS=Klk zocAlWeDV+=K!5-N0t5&UAV45Gfvx%Gda1me=c;5I2i48vi_4Rh!@2yuv9Or`+}>%m z_SW89ZSS_9KH49~@6_-2pWJ#-9nKyC1PBlyK!5-N0t5&UAV45yfzHLf((tzgS$%MR zry2b>!~zl^K!5-N0t5&UAV7cs0Rno}+yMdv2oNAZfB*pk1PBlykd}a6wY2svEdc@q z2oNAZfB*pk1PBnQ^}3C#KY}u9wQod9F&faZuenzPLPDIh@Pi8w-p1 z&+VO7Yj5qX)%I@t>7)H&{7(IT|H-Wf)#2FGyAV7cs0RjXF5FkK+Kmq~^0}@!W zhy(}_AV7cs0RjXF5FkJx5KtHpU>FGyAV7cs0RjXF5FkK+Kmq~^0}@!Why(}_AV7cs z0RjXF5FkJx6i^rtYM2QSAV7cs0RjXF5FkK+K>Pv<1LEJYgail>AV7cs0RjXF5FkJx z6i^rtYM2QSAV7cs0RjXF5FkK+K>Pv<1LEJYgail>AV7cs0RjXF5FkKcN-BI zK!5-N0t5&UAV7cs0Rn-5!hit7NPqwV0t5&UAV7cs0RjXP5KtJ9z>-BIK!5-N0t5&U zAV7cs0Rn-5!hit7NPqwV0t5&UAV7cs0RjY45KtJ9!j@$uK!5-N0t5&UAV7cs0Rn}9 z!hpiUM1TMR0t5&UAV7cs0RjY45KtJ9!j@$uK!5-N0t5&UAV7cs0Rn}9!hpiUM1TMR z0t5&UAV7cs0RjY)5KtJ9#F~X9K!5-N0t5&UAV7cs0Rj^Ng#i-^0|5dA2oNAZfB*pk z1PBmFLO@|a5^ENc009C72oNAZfB*pk1PDw76b4Kv3kj9>+BtU=w z0RjXF5FkK+009DHfumlxQ_ixiaW**bS8Dm>AwYlt0RjXF5FkK+Ky(6I^Ud|S`Q_4b zo~)8>98@=tFD_434(Ias#zHm7`}_Uj%l1yIwfFLBd$;}npZjk9U%NW@%53L;^?d32 z+^e&l`|#K0>vLeQ z2Oqya_ttFZ-p@X9eeU*6=N6~#%fAjkd42Ac8!ycC!Ee2=G&*?WjhR09^WS`GbnwP2 zGkx%{x0go;Z@e?p2fun+8y&py(o7%R``&Y-gE!uq>4Sgx@H3->H(s0RgP(ryv!jDI z-ka%z@6J6xI(Xy7nLhZzPhJ=uobl%T`-K;;5579%&H48G_0ho@Z_Y2i{`t|t8E?+t zPQNfZIOEM(edmj#gEQWoAO7P@qk}WvoYVJS8XcVR=G5lDJUTez&H4UMzcM;FgEQWo zAGhBa9h~vz{CWPZ(ZLyS&T~JzJvun!&DnnO?a{#*Z_e*N_{Qkq=;nN6VfcSaFXjLH OOC`(x`}Q~UxBmeQw--79 literal 0 HcmV?d00001 -- 2.39.5