From a37c6a7fd23ae17a18c4f2cda3153746e05efe97 Mon Sep 17 00:00:00 2001
From: whgojp <3242246891@qq.com>
Date: Fri, 21 Mar 2025 16:54:46 +0800
Subject: [PATCH 01/22] V1.4
---
.gitignore | 3 +-
Dockerfile | 2 +-
pom.xml | 66 +-
sql/JavaSecLab.sql | 51 +-
.../whgojp/common/utils/CheckUserInput.java | 27 +-
.../controller/FastjsonController.java | 5 +
.../controller/ReadObjectController.java | 36 +-
.../controller/SnakeYamlController.java | 1 +
.../funny/controller/HijackController.java | 26 +
.../logic/pay/controller/PayController.java | 221 ++-
.../controller/CredentialController.java | 54 +-
.../controller/SpringBootController.java | 89 +
.../springboot/entity/MaliciousObject.java | 21 +
.../xss/config/XssWebSocketConfig.java | 18 +
.../xss/config/XssWebSocketHandler.java | 53 +
.../xss/controller/ActionEnterRewrite.java | 4 -
.../modules/xss/controller/FileUtils.java | 53 +-
.../xss/controller/JsonpController.java | 17 +
.../xss/controller/OtherController.java | 6 +-
.../xss/controller/PostMessageController.java | 20 +
.../xss/controller/ReflectController.java | 116 +-
.../xss/controller/StoreController.java | 10 +-
.../controller/base/XssBaseController.java | 41 +
.../xss/service/impl/XssServiceImpl.java | 37 +-
src/main/resources/application-dev.yml | 60 +-
src/main/resources/application-docker.yml | 55 +-
src/main/resources/application.yml | 9 +-
src/main/resources/banner.txt | 7 +-
src/main/resources/static/api/init.json | 1 +
.../resources/static/images/vul/jdbc/jdbc.png | Bin 0 -> 152497 bytes
.../static/images/vul/memshell/filter.png | 1 +
.../static/images/vul/memshell/listener.png | 1 +
.../static/images/vul/memshell/servlet.png | 1 +
src/main/resources/static/js/jsencrypt.min.js | 1540 +++++++++++++++++
.../static/js/lay-module/common/common.js | 2 +-
src/main/resources/static/js/md5.min.js | 109 ++
src/main/resources/static/js/staticcode.js | 65 +-
.../static/lib/custom-icon/demo_index.html | 71 +-
.../static/lib/custom-icon/iconfont.css | 14 +-
.../static/lib/custom-icon/iconfont.js | 2 +-
.../static/lib/custom-icon/iconfont.json | 21 +
.../static/lib/custom-icon/iconfont.woff2 | Bin 15816 -> 16368 bytes
.../static/lib/layui-v2.6.3/css/layui.css | 23 +
src/main/resources/static/other/cookie.txt | 1 +
.../other/datapackage/file/delete.pcapng | Bin 0 -> 8360 bytes
.../other/datapackage/file/download.pcapng | Bin 0 -> 6288 bytes
.../datapackage/file/payload}/test.jsp | 0
.../static/other/datapackage/file/read.pcapng | Bin 0 -> 4420 bytes
.../other/datapackage/file/upload.pcapng | Bin 0 -> 4136 bytes
.../datapackage/rce/code_injection.pcapng | Bin 0 -> 7112 bytes
.../datapackage/rce/command_injection.pcapng | Bin 0 -> 6960 bytes
.../static/other/datapackage/spel/spel.pcapng | Bin 0 -> 3760 bytes
.../datapackage/springboot/actuator.pcapng | Bin 0 -> 3988 bytes
.../other/datapackage/springboot/druid.pcapng | Bin 0 -> 181832 bytes
.../datapackage/springboot/mysql_jdbc.pcapng | Bin 0 -> 4148 bytes
.../datapackage/springboot/swagger_ui.pcapng | Bin 0 -> 494464 bytes
.../datapackage/sqli/sqli_boolean.pcapng | Bin 0 -> 5104 bytes
.../other/datapackage/sqli/sqli_error.pcapng | Bin 0 -> 2792 bytes
.../other/datapackage/sqli/sqli_time.pcapng | Bin 0 -> 2776 bytes
.../other/datapackage/sqli/sqli_xpath.pcapng | Bin 0 -> 2748 bytes
.../static/other/datapackage/ssrf/ssrf.pcapng | Bin 0 -> 3592 bytes
.../other/datapackage/ssti/ssti_return.pcapng | Bin 0 -> 13988 bytes
.../other/datapackage/ssti/ssti_url.pcapng | Bin 0 -> 13608 bytes
.../xss/payload}/xss.html | 0
.../{demo => datapackage/xss/payload}/xss.pdf | Bin
.../{demo => datapackage/xss/payload}/xss.svg | 0
.../{demo => datapackage/xss/payload}/xss.xml | 0
.../other/datapackage/xss/xss_store.pcapng | Bin 0 -> 348204 bytes
.../other/datapackage/xss/xss_swagger.pcapng | Bin 0 -> 9992 bytes
.../other/datapackage/xss/xss_th_html.pcapng | Bin 0 -> 204964 bytes
.../other/datapackage/xss/xss_th_text.pcapng | Bin 0 -> 639500 bytes
.../datapackage/xss/xss_upload_html.pcapng | Bin 0 -> 5780 bytes
.../datapackage/xss/xss_upload_pdf.pcapng | Bin 0 -> 14520 bytes
.../datapackage/xss/xss_upload_svg.pcapng | Bin 0 -> 6800 bytes
.../datapackage/xss/xss_upload_xml.pcapng | Bin 0 -> 4240 bytes
src/main/resources/templates/index.html | 2 +-
src/main/resources/templates/login.html | 2 +-
src/main/resources/templates/system/home.html | 2 +-
.../templates/vul/deserialize/readObject.html | 7 +-
.../templates/vul/deserialize/snakeYaml.html | 3 +-
.../resources/templates/vul/file/delete.html | 12 +-
.../templates/vul/file/download.html | 13 +-
.../resources/templates/vul/file/read.html | 12 +-
.../resources/templates/vul/file/upload.html | 17 +-
.../resources/templates/vul/funny/hijack.html | 177 ++
.../templates/vul/funny/js/hijack.js | 77 +
.../templates/vul/infoleak/dirTraversal.html | 4 +-
.../vul/loginconfront/credential.html | 63 +-
.../vul/loginconfront/resetpass.html | 5 +-
.../templates/vul/loginconfront/reverse.html | 5 +-
.../resources/templates/vul/other/xpath.html | 2 +-
.../resources/templates/vul/rce/code.html | 12 +-
.../resources/templates/vul/rce/command.html | 12 +-
.../resources/templates/vul/spel/spel.html | 13 +-
.../templates/vul/springboot/springboot.html | 142 +-
.../templates/vul/sqli/jdbcSpecial.html | 2 +-
.../resources/templates/vul/sqli/jdbcVul.html | 51 +-
.../resources/templates/vul/sqli/mybatis.html | 2 +-
.../resources/templates/vul/ssrf/ssrf.html | 24 +-
.../resources/templates/vul/ssti/ssti.html | 42 +-
src/main/resources/templates/vul/xss/dom.html | 143 +-
.../resources/templates/vul/xss/other.html | 330 +++-
.../vul/xss/postmessage/receiver.html | 54 +
.../templates/vul/xss/postmessage/sender.html | 47 +
.../{reflect-safe.html => reflect/safe.html} | 14 +-
.../{reflect-vul.html => reflect/vul.html} | 10 +-
.../resources/templates/vul/xss/store.html | 35 +-
107 files changed, 3939 insertions(+), 357 deletions(-)
create mode 100644 src/main/java/top/whgojp/modules/funny/controller/HijackController.java
create mode 100644 src/main/java/top/whgojp/modules/springboot/entity/MaliciousObject.java
create mode 100644 src/main/java/top/whgojp/modules/xss/config/XssWebSocketConfig.java
create mode 100644 src/main/java/top/whgojp/modules/xss/config/XssWebSocketHandler.java
create mode 100644 src/main/java/top/whgojp/modules/xss/controller/JsonpController.java
create mode 100644 src/main/java/top/whgojp/modules/xss/controller/PostMessageController.java
create mode 100644 src/main/java/top/whgojp/modules/xss/controller/base/XssBaseController.java
create mode 100644 src/main/resources/static/images/vul/jdbc/jdbc.png
create mode 100644 src/main/resources/static/images/vul/memshell/filter.png
create mode 100644 src/main/resources/static/images/vul/memshell/listener.png
create mode 100644 src/main/resources/static/images/vul/memshell/servlet.png
create mode 100644 src/main/resources/static/js/jsencrypt.min.js
create mode 100644 src/main/resources/static/js/md5.min.js
create mode 100644 src/main/resources/static/other/datapackage/file/delete.pcapng
create mode 100644 src/main/resources/static/other/datapackage/file/download.pcapng
rename src/main/resources/static/{upload => other/datapackage/file/payload}/test.jsp (100%)
create mode 100644 src/main/resources/static/other/datapackage/file/read.pcapng
create mode 100644 src/main/resources/static/other/datapackage/file/upload.pcapng
create mode 100644 src/main/resources/static/other/datapackage/rce/code_injection.pcapng
create mode 100644 src/main/resources/static/other/datapackage/rce/command_injection.pcapng
create mode 100644 src/main/resources/static/other/datapackage/spel/spel.pcapng
create mode 100644 src/main/resources/static/other/datapackage/springboot/actuator.pcapng
create mode 100644 src/main/resources/static/other/datapackage/springboot/druid.pcapng
create mode 100644 src/main/resources/static/other/datapackage/springboot/mysql_jdbc.pcapng
create mode 100644 src/main/resources/static/other/datapackage/springboot/swagger_ui.pcapng
create mode 100644 src/main/resources/static/other/datapackage/sqli/sqli_boolean.pcapng
create mode 100644 src/main/resources/static/other/datapackage/sqli/sqli_error.pcapng
create mode 100644 src/main/resources/static/other/datapackage/sqli/sqli_time.pcapng
create mode 100644 src/main/resources/static/other/datapackage/sqli/sqli_xpath.pcapng
create mode 100644 src/main/resources/static/other/datapackage/ssrf/ssrf.pcapng
create mode 100644 src/main/resources/static/other/datapackage/ssti/ssti_return.pcapng
create mode 100644 src/main/resources/static/other/datapackage/ssti/ssti_url.pcapng
rename src/main/resources/static/other/{demo => datapackage/xss/payload}/xss.html (100%)
rename src/main/resources/static/other/{demo => datapackage/xss/payload}/xss.pdf (100%)
rename src/main/resources/static/other/{demo => datapackage/xss/payload}/xss.svg (100%)
rename src/main/resources/static/other/{demo => datapackage/xss/payload}/xss.xml (100%)
create mode 100644 src/main/resources/static/other/datapackage/xss/xss_store.pcapng
create mode 100644 src/main/resources/static/other/datapackage/xss/xss_swagger.pcapng
create mode 100644 src/main/resources/static/other/datapackage/xss/xss_th_html.pcapng
create mode 100644 src/main/resources/static/other/datapackage/xss/xss_th_text.pcapng
create mode 100644 src/main/resources/static/other/datapackage/xss/xss_upload_html.pcapng
create mode 100644 src/main/resources/static/other/datapackage/xss/xss_upload_pdf.pcapng
create mode 100644 src/main/resources/static/other/datapackage/xss/xss_upload_svg.pcapng
create mode 100644 src/main/resources/static/other/datapackage/xss/xss_upload_xml.pcapng
create mode 100644 src/main/resources/templates/vul/funny/hijack.html
create mode 100644 src/main/resources/templates/vul/funny/js/hijack.js
create mode 100644 src/main/resources/templates/vul/xss/postmessage/receiver.html
create mode 100644 src/main/resources/templates/vul/xss/postmessage/sender.html
rename src/main/resources/templates/vul/xss/{reflect-safe.html => reflect/safe.html} (98%)
rename src/main/resources/templates/vul/xss/{reflect-vul.html => reflect/vul.html} (98%)
diff --git a/.gitignore b/.gitignore
index 3b720ab..ee547e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,4 +36,5 @@ build/
/logs/
/.idea/
-/src/test/
\ No newline at end of file
+/src/test/
+src/main/resources/application-aliyun.yml
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 876ae8e..f345b4c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@ FROM openjdk:8
WORKDIR /work
LABEL maintainer="whgojp@foxmail.com"
-LABEL version="1.3"
+LABEL version="1.4"
LABEL description="I think therefore I am."
COPY target/JavaSecLab.jar /work/JavaSecLab.jar
diff --git a/pom.xml b/pom.xml
index c7abdbb..8795ba1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -8,14 +8,14 @@
JavaSecLab
1.3.0
Java综合漏洞平台
- hello JavaSec!
+ hello JavaSecLab!
org.springframework.boot
spring-boot-starter-parent
-
- 2.4.1
-
+
+ 2.4.1
+
@@ -26,9 +26,10 @@
5.8.21
1.18.4
3.5.1
- 8.0.33
+
+ 8.0.14
2.2.0.0
- 0.10.7
+ 0.11.5
@@ -106,12 +107,18 @@
+
+
+
+
+
- com.mysql
- mysql-connector-j
- ${mysql.version}
+ mysql
+ mysql-connector-java
+ 8.0.14
+
com.baomidou
@@ -271,7 +278,23 @@
1.70
+
+ ognl
+ ognl
+ 3.3.1
+
+
+ commons-collections
+ commons-collections
+ 3.2.1
+
+
+
+ org.springframework.boot
+ spring-boot-starter-websocket
+ 2.4.1
+
@@ -296,29 +319,16 @@
+
- central
- https://repo.maven.apache.org/maven2
-
-
- spring-milestone
- https://repo.spring.io/milestone
-
-
- spring-release
- https://repo.spring.io/release
+ aliyun-central
+ https://maven.aliyun.com/repository/central
- acfunnexus
- https://maven.aliyun.com/repository/public/
- default
-
- true
-
-
- true
-
+ aliyun-public
+ https://maven.aliyun.com/repository/public
+
diff --git a/sql/JavaSecLab.sql b/sql/JavaSecLab.sql
index d1051d7..70584d6 100644
--- a/sql/JavaSecLab.sql
+++ b/sql/JavaSecLab.sql
@@ -1,5 +1,5 @@
/*
- Navicat Premium Data Transfer
+ Navicat Premium Dump SQL
Source Server : mysql_docker_mac
Source Server Type : MySQL
@@ -11,10 +11,8 @@
Target Server Version : 80200 (8.2.0)
File Encoding : 65001
- Date: 10/11/2024 13:17:18
+ Date: 21/03/2025 16:51:30
*/
-CREATE DATABASE IF NOT EXISTS JavaSecLab;
-USE JavaSecLab;
SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;
@@ -25,8 +23,8 @@ SET FOREIGN_KEY_CHECKS = 0;
DROP TABLE IF EXISTS `hsqli`;
CREATE TABLE `hsqli` (
`id` bigint NOT NULL AUTO_INCREMENT,
- `password` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL,
- `username` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL,
+ `password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL,
+ `username` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL,
PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
@@ -41,11 +39,11 @@ COMMIT;
-- ----------------------------
DROP TABLE IF EXISTS `log`;
CREATE TABLE `log` (
- `logId` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT 'log_id',
- `username` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '用户名',
- `optionName` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '用户操作',
- `optionTerminal` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '操作终端',
- `optionIp` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT 'Ip地址',
+ `logId` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT 'log_id',
+ `username` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '用户名',
+ `optionName` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '用户操作',
+ `optionTerminal` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '操作终端',
+ `optionIp` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT 'Ip地址',
`optionTime` date DEFAULT NULL COMMENT '创建时间',
PRIMARY KEY (`logId`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
@@ -56,14 +54,31 @@ CREATE TABLE `log` (
BEGIN;
COMMIT;
+-- ----------------------------
+-- Table structure for objects
+-- ----------------------------
+DROP TABLE IF EXISTS `objects`;
+CREATE TABLE `objects` (
+ `id` int NOT NULL,
+ `malicious_object` blob,
+ PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
+
+-- ----------------------------
+-- Records of objects
+-- ----------------------------
+BEGIN;
+INSERT INTO `objects` (`id`, `malicious_object`) VALUES (1, 0xACED000573720034746F702E7768676F6A702E6D6F64756C65732E737072696E67626F6F742E656E746974792E4D616C6963696F75734F626A656374C007A841C29C41060200014C0007636F6D6D616E647400124C6A6176612F6C616E672F537472696E673B78707400126F70656E202D612043616C63756C61746F72);
+COMMIT;
+
-- ----------------------------
-- Table structure for sqli
-- ----------------------------
DROP TABLE IF EXISTS `sqli`;
CREATE TABLE `sqli` (
`id` int NOT NULL AUTO_INCREMENT,
- `username` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '用户名',
- `password` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '密码',
+ `username` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '用户名',
+ `password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '密码',
PRIMARY KEY (`id`) USING BTREE
) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
@@ -79,8 +94,8 @@ COMMIT;
-- ----------------------------
DROP TABLE IF EXISTS `user`;
CREATE TABLE `user` (
- `username` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '用户名',
- `password` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '密码',
+ `username` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '用户名',
+ `password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '密码',
PRIMARY KEY (`username`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
@@ -99,11 +114,11 @@ COMMIT;
DROP TABLE IF EXISTS `xss`;
CREATE TABLE `xss` (
`id` int NOT NULL AUTO_INCREMENT COMMENT '主键id',
- `content` text COLLATE utf8mb4_general_ci NOT NULL COMMENT '插入内容',
+ `content` text CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '插入内容',
`ua` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT 'User-Agent',
- `date` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '插入时间',
+ `date` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '插入时间',
PRIMARY KEY (`id`)
-) ENGINE=InnoDB AUTO_INCREMENT=82 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
+) ENGINE=InnoDB AUTO_INCREMENT=84 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
-- ----------------------------
-- Records of xss
diff --git a/src/main/java/top/whgojp/common/utils/CheckUserInput.java b/src/main/java/top/whgojp/common/utils/CheckUserInput.java
index 13f8ad9..8f191d8 100644
--- a/src/main/java/top/whgojp/common/utils/CheckUserInput.java
+++ b/src/main/java/top/whgojp/common/utils/CheckUserInput.java
@@ -1,12 +1,13 @@
package top.whgojp.common.utils;
import org.springframework.stereotype.Component;
-
+import org.springframework.web.util.HtmlUtils;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
+import java.util.regex.Pattern;
/**
* @description 用户输入数据校验
@@ -16,6 +17,30 @@
*/
@Component
public class CheckUserInput {
+ private static final Pattern SCRIPT_PATTERN = Pattern.compile("]*>.*?", Pattern.CASE_INSENSITIVE | Pattern.DOTALL);
+ private static final Pattern EVENT_PATTERN = Pattern.compile("on\\w+\\s*=", Pattern.CASE_INSENSITIVE);
+ private static final Pattern JAVASCRIPT_PATTERN = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
+
+ public String filter(String input) {
+ if (input == null) {
+ return "";
+ }
+
+ // 基本HTML转义
+ String filtered = HtmlUtils.htmlEscape(input);
+
+ // 移除script标签
+ filtered = SCRIPT_PATTERN.matcher(filtered).replaceAll("");
+
+ // 移除事件处理器
+ filtered = EVENT_PATTERN.matcher(filtered).replaceAll("");
+
+ // 移除javascript:协议
+ filtered = JAVASCRIPT_PATTERN.matcher(filtered).replaceAll("");
+
+ return filtered;
+ }
+
public String checkUser(String username, String password, Integer id) {
String message = "";
if (username == null || username.isEmpty()) {
diff --git a/src/main/java/top/whgojp/modules/components/fastjson/controller/FastjsonController.java b/src/main/java/top/whgojp/modules/components/fastjson/controller/FastjsonController.java
index 0e7e200..03de345 100644
--- a/src/main/java/top/whgojp/modules/components/fastjson/controller/FastjsonController.java
+++ b/src/main/java/top/whgojp/modules/components/fastjson/controller/FastjsonController.java
@@ -38,6 +38,11 @@ public String vul(@RequestBody String content) {
}
}
+ public String vul2(){
+
+ return "";
+ }
+
@PostMapping("/safe")
@ResponseBody
public String safe(@RequestBody String content) {
diff --git a/src/main/java/top/whgojp/modules/deserialize/readobject/controller/ReadObjectController.java b/src/main/java/top/whgojp/modules/deserialize/readobject/controller/ReadObjectController.java
index f49db0f..e014f8e 100644
--- a/src/main/java/top/whgojp/modules/deserialize/readobject/controller/ReadObjectController.java
+++ b/src/main/java/top/whgojp/modules/deserialize/readobject/controller/ReadObjectController.java
@@ -8,6 +8,9 @@
import org.springframework.web.bind.annotation.*;
import top.whgojp.common.utils.R;
import top.whgojp.modules.sqli.entity.Sqli;
+import java.io.ByteArrayInputStream;
+import java.io.ObjectInputStream;
+
import java.io.ByteArrayInputStream;
import java.util.Base64;
@@ -30,23 +33,46 @@ public String readObject(){
return "vul/deserialize/readObject";
}
+// @RequestMapping("/vul")
+// @ResponseBody
+// public R vul(String payload) {
+// System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "true");
+// log.info("Java反序列化："+payload);
+// try {
+// payload = payload.replace(" ", "+");
+// byte[] bytes = Base64.getDecoder().decode(payload);
+// ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
+// java.io.ObjectInputStream in = new java.io.ObjectInputStream(stream);
+// in.readObject();
+// in.close();
+// return R.ok("[+]Java反序列化：ObjectInputStream.readObject()");
+// } catch (Exception e) {
+// return R.error("[-]请输入正确的Payload！\n"+e.getMessage());
+// }
+// }
@RequestMapping("/vul")
@ResponseBody
public R vul(String payload) {
System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "true");
- log.info("Java反序列化："+payload);
+ log.info("Java反序列化：" + payload);
try {
payload = payload.replace(" ", "+");
byte[] bytes = Base64.getDecoder().decode(payload);
ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
- java.io.ObjectInputStream in = new java.io.ObjectInputStream(stream);
- in.readObject();
+ ObjectInputStream in = new ObjectInputStream(stream);
+
+ Object obj = in.readObject();
+ log.info("反序列化对象：" + obj.toString());
+
in.close();
- return R.ok("[+]Java反序列化：ObjectInputStream.readObject()");
+ return R.ok("[+]Java反序列化："+obj);
} catch (Exception e) {
- return R.error("[-]请输入正确的Payload！\n"+e.getMessage());
+ return R.error("[-] 请输入正确的 Payload！\n" + e.getMessage());
}
}
+
+
+
@RequestMapping("/safe1")
@ResponseBody
public R safe1(String payload) {
diff --git a/src/main/java/top/whgojp/modules/deserialize/snakeyaml/controller/controller/SnakeYamlController.java b/src/main/java/top/whgojp/modules/deserialize/snakeyaml/controller/controller/SnakeYamlController.java
index 20d5592..25c3792 100644
--- a/src/main/java/top/whgojp/modules/deserialize/snakeyaml/controller/controller/SnakeYamlController.java
+++ b/src/main/java/top/whgojp/modules/deserialize/snakeyaml/controller/controller/SnakeYamlController.java
@@ -32,6 +32,7 @@ public String snakeYaml(){
@RequestMapping("/vul")
@ResponseBody
public R vul(String payload) {
+ log.info("payload："+payload);
Yaml y = new Yaml();
y.load(payload);
return R.ok("[+]Java反序列化：SnakeYaml原生漏洞");
diff --git a/src/main/java/top/whgojp/modules/funny/controller/HijackController.java b/src/main/java/top/whgojp/modules/funny/controller/HijackController.java
new file mode 100644
index 0000000..ab1df77
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/funny/controller/HijackController.java
@@ -0,0 +1,26 @@
+package top.whgojp.modules.funny.controller;
+
+import io.swagger.annotations.Api;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+/**
+ * @description <功能描述>
+ * @author: whgojp
+ * @email: whgojp@foxmail.com
+ * @Date: 2025/1/17 16:31
+ */
+@Slf4j
+@Api(value = "HijackController", tags = "劫持模块")
+@Controller
+@CrossOrigin(origins = "*")
+@RequestMapping("/funny/hijack")
+public class HijackController {
+ @RequestMapping()
+ public String hijack(){
+ return "/vul/funny/hijack";
+ }
+
+}
diff --git a/src/main/java/top/whgojp/modules/logic/pay/controller/PayController.java b/src/main/java/top/whgojp/modules/logic/pay/controller/PayController.java
index 0abbb85..328461f 100644
--- a/src/main/java/top/whgojp/modules/logic/pay/controller/PayController.java
+++ b/src/main/java/top/whgojp/modules/logic/pay/controller/PayController.java
@@ -1,10 +1,229 @@
package top.whgojp.modules.logic.pay.controller;
+import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiOperation;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import top.whgojp.common.utils.R;
+
+import java.math.BigDecimal;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.HashMap;
+
/**
- * @description <功能描述>
+ * @description 逻辑漏洞-支付漏洞
* @author: whgojp
* @email: whgojp@foxmail.com
* @Date: 2024/8/28 22:07
*/
+@Slf4j
+@Api(value = "PayController", tags = "逻辑漏洞-支付漏洞")
+@Controller
+@CrossOrigin(origins = "*")
+@RequestMapping("/logic/pay")
public class PayController {
+ // 用户余额
+ private final AtomicReference userMoney = new AtomicReference<>(new BigDecimal("1000.00"));
+ // 商品单价（用于服务端验证）
+ private final BigDecimal goodPrice = new BigDecimal("100.00");
+ // 订单状态缓存
+ private final Map orderStatusMap = new ConcurrentHashMap<>();
+ // 支付状态缓存（用于防止重复支付）
+ private final Map paymentStatusMap = new ConcurrentHashMap<>();
+
+ @RequestMapping("")
+ public String pay() {
+ return "/vul/logic/pay/pay";
+ }
+
+ /**
+ * 订单状态类
+ */
+ private static class OrderStatus {
+ BigDecimal amount;
+ boolean isPaid;
+ String orderId;
+
+ public OrderStatus(String orderId, BigDecimal amount) {
+ this.orderId = orderId;
+ this.amount = amount;
+ this.isPaid = false;
+ }
+ }
+
+ /**
+ * 漏洞场景1：支付金额参数篡改
+ * 由于未对客户端传入的价格参数进行验证，攻击者可以修改支付金额
+ */
+ @ApiOperation("支付金额参数篡改漏洞")
+ @RequestMapping("/vul1")
+ @ResponseBody
+ public R vul1(@RequestParam String count, @RequestParam String price) {
+ try {
+ double totalPrice = Integer.parseInt(count) * Double.parseDouble(price);
+ log.info("用户需支付金额：" + totalPrice);
+
+ // 直接使用客户端传入的价格，未与服务端商品实际价格进行校验
+ BigDecimal currentMoney = userMoney.get();
+ if (currentMoney.compareTo(BigDecimal.valueOf(totalPrice)) < 0) {
+ return R.error("支付金额不足，支付失败！");
+ }
+ userMoney.set(currentMoney.subtract(BigDecimal.valueOf(totalPrice)));
+ return R.ok("支付成功！剩余余额：" + userMoney.get());
+ } catch (Exception e) {
+ return R.error(e.toString());
+ }
+ }
+
+ /**
+ * 漏洞场景2：订单重放攻击
+ * 由于未对订单是否重复支付进行验证，攻击者可以重复发送相同的支付请求
+ */
+ @ApiOperation("订单重放攻击漏洞")
+ @RequestMapping("/vul2")
+ @ResponseBody
+ public R vul2(@RequestParam String orderId, @RequestParam double amount) {
+ // 未检查订单是否已支付
+ // 这里应该使用paymentStatusMap检查订单是否已支付，但为了演示漏洞，故意不检查
+ BigDecimal currentMoney = userMoney.get();
+ if (currentMoney.compareTo(BigDecimal.valueOf(amount)) < 0) {
+ return R.error("余额不足");
+ }
+ userMoney.set(currentMoney.subtract(BigDecimal.valueOf(amount)));
+ return R.ok("支付成功！剩余余额：" + userMoney.get());
+ }
+
+ /**
+ * 漏洞场景3：竞态条件漏洞
+ * 由于未正确处理并发支付请求，可能导致重复扣款或余额计算错误
+ */
+ @ApiOperation("竞态条件漏洞")
+ @RequestMapping("/vul3")
+ @ResponseBody
+ public R vul3(@RequestParam String orderId, @RequestParam double amount) {
+ // 模拟处理延迟
+ try {
+ Thread.sleep(1000);
+ } catch (InterruptedException e) {
+ Thread.currentThread().interrupt();
+ }
+
+ BigDecimal currentMoney = userMoney.get();
+ if (currentMoney.compareTo(BigDecimal.valueOf(amount)) < 0) {
+ return R.error("余额不足");
+ }
+ userMoney.set(currentMoney.subtract(BigDecimal.valueOf(amount)));
+ return R.ok("支付成功！剩余余额：" + userMoney.get());
+ }
+
+ /**
+ * 漏洞场景4：支付流程绕过
+ * 由于状态校验不完整，攻击者可能绕过支付流程直接修改订单状态
+ */
+ @ApiOperation("支付流程绕过漏洞 - 创建订单")
+ @RequestMapping("/vul4/create")
+ @ResponseBody
+ public R createOrder(@RequestParam String orderId, @RequestParam double amount) {
+ OrderStatus status = new OrderStatus(orderId, BigDecimal.valueOf(amount));
+ orderStatusMap.put(orderId, status);
+ Map data = new HashMap<>();
+ data.put("orderId", orderId);
+ data.put("amount", amount);
+ return R.ok("订单创建成功").put("data", data);
+ }
+
+ @ApiOperation("支付流程绕过漏洞 - 查询订单状态")
+ @RequestMapping("/vul4/status")
+ @ResponseBody
+ public R getOrderStatus(@RequestParam String orderId) {
+ OrderStatus status = orderStatusMap.get(orderId);
+ if (status == null) {
+ return R.error("订单不存在");
+ }
+ Map data = new HashMap<>();
+ data.put("orderId", status.orderId);
+ data.put("amount", status.amount);
+ data.put("isPaid", status.isPaid);
+ return R.ok().put("data", data);
+ }
+
+ @ApiOperation("支付流程绕过漏洞 - 支付通知")
+ @RequestMapping("/vul4/notify")
+ @ResponseBody
+ public R paymentNotify(@RequestParam String orderId, @RequestParam boolean success) {
+ // 未验证通知来源，直接更新订单状态
+ OrderStatus status = orderStatusMap.get(orderId);
+ if (status == null) {
+ return R.error("订单不存在");
+ }
+ status.isPaid = success;
+ return R.ok("状态更新成功");
+ }
+
+
+ /**
+ * 漏洞场景5：整数溢出漏洞
+ * 当count或price数值过大时，可能会导致整数溢出
+ */
+ @ApiOperation("整数溢出漏洞")
+ @RequestMapping("/vul5")
+ @ResponseBody
+ public R integerOverflow(@RequestParam String count, @RequestParam String price) {
+ try {
+ Integer countValue = Integer.valueOf(count);
+ Integer priceValue = Integer.valueOf(price);
+
+ // 整数溢出场景：当 count 或 price 数值过大时，可能会导致溢出
+ int totalAmount = countValue * priceValue;
+ log.info("用户需支付金额：" + totalAmount);
+
+ BigDecimal currentMoney = userMoney.get();
+ if (currentMoney.compareTo(BigDecimal.valueOf(totalAmount)) < 0) {
+ return R.error("支付金额不足，支付失败！");
+ }
+ userMoney.set(currentMoney.subtract(BigDecimal.valueOf(totalAmount)));
+ return R.ok("支付成功！剩余余额：" + userMoney.get());
+ } catch (Exception e) {
+ return R.error("无效的输入，请输入有效的数量和价格！");
+ }
+ }
+
+ /**
+ * 漏洞场景6：浮点数精度漏洞
+ * 由于未正确处理浮点数精度，可能导致金额计算不准确
+ */
+ @ApiOperation("浮点数精度漏洞")
+ @RequestMapping("/vul6")
+ @ResponseBody
+ public R floatingPointPrecision(@RequestParam String count, @RequestParam String price) {
+ try {
+ // 使用BigDecimal处理金额计算，避免浮点数精度问题
+ BigDecimal amountValue = new BigDecimal(price).multiply(new BigDecimal(count));
+ log.info("用户需支付金额：" + amountValue);
+
+ BigDecimal currentMoney = userMoney.get();
+ if (currentMoney.compareTo(amountValue) < 0) {
+ return R.error("支付金额不足，支付失败！");
+ }
+ userMoney.set(currentMoney.subtract(amountValue));
+ return R.ok("支付成功！剩余余额：" + userMoney.get());
+ } catch (Exception e) {
+ return R.error("无效的输入，请输入有效的数量和价格！");
+ }
+ }
+
+ @ApiOperation("重置用户余额")
+ @RequestMapping("/resetBalance")
+ @ResponseBody
+ public R resetBalance() {
+ userMoney.set(new BigDecimal("1000.00"));
+ return R.ok("余额已重置为1000.00元");
+ }
}
diff --git a/src/main/java/top/whgojp/modules/loginconfront/controller/CredentialController.java b/src/main/java/top/whgojp/modules/loginconfront/controller/CredentialController.java
index a8c5d91..b9774aa 100644
--- a/src/main/java/top/whgojp/modules/loginconfront/controller/CredentialController.java
+++ b/src/main/java/top/whgojp/modules/loginconfront/controller/CredentialController.java
@@ -1,12 +1,19 @@
package top.whgojp.modules.loginconfront.controller;
+import io.jsonwebtoken.*;
+import io.jsonwebtoken.security.Keys;
import io.swagger.annotations.Api;
import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.CrossOrigin;
-import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.*;
import top.whgojp.common.utils.R;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.http.HttpSession;
+import java.nio.charset.StandardCharsets;
+import java.security.Key;
+
/**
* @description 登录对抗-凭证安全
* @author: whgojp
@@ -24,9 +31,48 @@ public String credential() {
return "vul/loginconfront/credential";
}
+ // 生成一个符合HS256要求的强密钥（至少256位）
+ @Value("${jwt.key}")
+ String secretKey = "f3a4c6d5b9bfeff28b1f529b0840134bcd4183474e2d4a97c05615a134e4f4da";
+ Key key = new SecretKeySpec(secretKey.getBytes(StandardCharsets.UTF_8), SignatureAlgorithm.HS256.getJcaName());
+
+// Key key = Keys.secretKeyFor(SignatureAlgorithm.HS256);
+
+ @GetMapping("/generate-jwt")
+ @ResponseBody
+ public R generateJWT(String username, String role) {
+ String jwt = Jwts.builder()
+ .setSubject(username)
+ .claim("role", role)
+ .signWith(key)
+ .compact();
+ log.info("生成的JWT: " + jwt);
+ return R.ok(jwt);
+ }
+
@RequestMapping("/vul1")
- public R vul1() {
- return R.ok();
+ @ResponseBody
+ public R vul1(@RequestHeader("Auth_Token") String jwt) { // 从请求头获取 JWT
+ log.info("获取到的JWT：" + jwt);
+ try {
+ String user = Jwts.parser()
+ .setSigningKey(key)
+ .parseClaimsJws(jwt)
+ .getBody()
+ .getSubject();
+ String role = Jwts.parserBuilder()
+ .setSigningKey(key)
+ .build()
+ .parseClaimsJws(jwt)
+ .getBody()
+ .get("role", String.class);
+
+ log.info("JWT解析成功，用户：" + user);
+ return R.ok("JWT解析成功，user：" + user+",role："+role);
+ } catch (Exception e) {
+ log.info("JWT解析失败：" + e.getMessage());
+ return R.error("JWT解析失败：" + e.getMessage());
+ }
}
@RequestMapping("/vul2")
diff --git a/src/main/java/top/whgojp/modules/springboot/controller/SpringBootController.java b/src/main/java/top/whgojp/modules/springboot/controller/SpringBootController.java
index 20ffe20..aa0ed81 100644
--- a/src/main/java/top/whgojp/modules/springboot/controller/SpringBootController.java
+++ b/src/main/java/top/whgojp/modules/springboot/controller/SpringBootController.java
@@ -2,9 +2,20 @@
import io.swagger.annotations.Api;
import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import top.whgojp.common.utils.R;
+import top.whgojp.modules.springboot.entity.MaliciousObject;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.sql.*;
/**
* @description java专题-SpringBoot相关漏洞
@@ -23,4 +34,82 @@ public String springboot() {
return "vul/springboot/springboot";
}
+ @Value("${spring.datasource.url:jdbc:mysql://localhost:13306/JavaSecLab}")
+ String url = "";
+ @Value("${spring.datasource.username:jdbc:root}")
+ String username = "";
+ @Value("${spring.datasource.password:jdbc:QWE123qwe}")
+ String password = "";
+
+ @RequestMapping("/jdbc")
+ @ResponseBody
+ public R jdbc() {
+ try {
+ Connection conn = DriverManager.getConnection(url, username, password);
+ String selectQuery = "SELECT malicious_object FROM objects WHERE id = 1";
+ Statement stmt = conn.createStatement();
+ ResultSet rs = stmt.executeQuery(selectQuery);
+
+ if (rs.next()) {
+ byte[] maliciousObjectBytes = rs.getBytes("malicious_object");
+ // 反序列化恶意对象
+ ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(maliciousObjectBytes);
+ ObjectInputStream objectInputStream = new ObjectInputStream(byteArrayInputStream);
+
+ MaliciousObject maliciousObject = (MaliciousObject) objectInputStream.readObject();
+
+ log.info("触发MYSQL-JBDC反序列化漏洞！");
+ }
+
+ stmt.close();
+ conn.close();
+
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+ return R.ok("触发MYSQL-JBDC反序列化漏洞！");
+ }
+
+ @RequestMapping("/insert")
+ @ResponseBody
+ public R insertMaliciousObject(@RequestParam String command) {
+ try {
+ MaliciousObject maliciousObject = new MaliciousObject(command);
+
+ ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ ObjectOutputStream oos = new ObjectOutputStream(baos);
+ oos.writeObject(maliciousObject);
+ byte[] objectBytes = baos.toByteArray();
+
+ Connection conn = DriverManager.getConnection(url, username, password);
+ String insertQuery = "INSERT INTO objects (id, malicious_object) VALUES (?, ?)";
+ PreparedStatement stmt = conn.prepareStatement(insertQuery);
+ stmt.setInt(1, 1);
+ stmt.setBytes(2, objectBytes);
+ stmt.executeUpdate();
+ stmt.close();
+ conn.close();
+
+ return R.ok("恶意对象插入成功！");
+ } catch (Exception e) {
+ e.printStackTrace();
+ return R.error("恶意对象插入失败(主键冲突的话在请数据库中删除该记录)：" + e.getMessage());
+ }
+ }
+
+ @RequestMapping("/vul")
+ @ResponseBody
+ public R vul(String url, String username, String password) {
+
+ try {
+// Class.forName("com.mysql.jdbc.Driver");
+ Class.forName("com.mysql.cj.jdbc.Driver");
+ DriverManager.getConnection(url,username,password);
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+ return R.ok();
+ }
+
+
}
diff --git a/src/main/java/top/whgojp/modules/springboot/entity/MaliciousObject.java b/src/main/java/top/whgojp/modules/springboot/entity/MaliciousObject.java
new file mode 100644
index 0000000..34ed3cd
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/springboot/entity/MaliciousObject.java
@@ -0,0 +1,21 @@
+package top.whgojp.modules.springboot.entity;
+
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.io.Serializable;
+
+public class MaliciousObject implements Serializable {
+ private String command;
+
+ public MaliciousObject(String command) {
+ this.command = command;
+ }
+
+ private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
+ String command = (String) in.readObject();
+ if (command != null) {
+ Runtime.getRuntime().exec(command);
+ }
+ }
+
+}
diff --git a/src/main/java/top/whgojp/modules/xss/config/XssWebSocketConfig.java b/src/main/java/top/whgojp/modules/xss/config/XssWebSocketConfig.java
new file mode 100644
index 0000000..e1e67f6
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/config/XssWebSocketConfig.java
@@ -0,0 +1,18 @@
+package top.whgojp.modules.xss.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.lang.NonNull;
+import org.springframework.web.socket.config.annotation.EnableWebSocket;
+import org.springframework.web.socket.config.annotation.WebSocketConfigurer;
+import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry;
+
+@Configuration
+@EnableWebSocket
+public class XssWebSocketConfig implements WebSocketConfigurer {
+
+ @Override
+ public void registerWebSocketHandlers(@NonNull WebSocketHandlerRegistry registry) {
+ registry.addHandler(new XssWebSocketHandler(), "/xss/websocket")
+ .setAllowedOrigins("*"); // 故意允许所有源，用于演示XSS风险
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/config/XssWebSocketHandler.java b/src/main/java/top/whgojp/modules/xss/config/XssWebSocketHandler.java
new file mode 100644
index 0000000..18488ef
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/config/XssWebSocketHandler.java
@@ -0,0 +1,53 @@
+package top.whgojp.modules.xss.config;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.lang.NonNull;
+import org.springframework.web.socket.CloseStatus;
+import org.springframework.web.socket.TextMessage;
+import org.springframework.web.socket.WebSocketSession;
+import org.springframework.web.socket.handler.TextWebSocketHandler;
+
+import java.io.IOException;
+import java.util.concurrent.CopyOnWriteArraySet;
+
+@Slf4j
+public class XssWebSocketHandler extends TextWebSocketHandler {
+
+ private static final CopyOnWriteArraySet sessions = new CopyOnWriteArraySet<>();
+
+ @Override
+ public void afterConnectionEstablished(@NonNull WebSocketSession session) {
+ sessions.add(session);
+ log.info("WebSocket connection established - Current connections: {}", sessions.size());
+ try {
+ session.sendMessage(new TextMessage("Connected successfully"));
+ } catch (IOException e) {
+ log.error("Failed to send welcome message: {}", e.getMessage());
+ }
+ }
+
+ @Override
+ protected void handleTextMessage(@NonNull WebSocketSession session, @NonNull TextMessage message) {
+ log.info("Received message: {}", message.getPayload());
+ // 故意不过滤消息内容，用于演示XSS风险
+ broadcast(message);
+ }
+
+ @Override
+ public void afterConnectionClosed(@NonNull WebSocketSession session, @NonNull CloseStatus status) {
+ sessions.remove(session);
+ log.info("WebSocket connection closed - Current connections: {}", sessions.size());
+ }
+
+ private void broadcast(TextMessage message) {
+ for (WebSocketSession session : sessions) {
+ try {
+ if (session.isOpen()) {
+ session.sendMessage(message);
+ }
+ } catch (IOException e) {
+ log.error("Failed to send message to session {}: {}", session.getId(), e.getMessage());
+ }
+ }
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/ActionEnterRewrite.java b/src/main/java/top/whgojp/modules/xss/controller/ActionEnterRewrite.java
index cae747e..6c197b6 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/ActionEnterRewrite.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/ActionEnterRewrite.java
@@ -14,10 +14,6 @@
import javax.servlet.http.HttpServletRequest;
import java.util.Map;
-/**
- * 描述:
- * 创建人: 慌途L
- */
@Slf4j
public class ActionEnterRewrite {
private HttpServletRequest request;
diff --git a/src/main/java/top/whgojp/modules/xss/controller/FileUtils.java b/src/main/java/top/whgojp/modules/xss/controller/FileUtils.java
index d5ab2ec..9a63996 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/FileUtils.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/FileUtils.java
@@ -11,48 +11,47 @@
import java.io.File;
import java.io.IOException;
-import java.util.Random;
+import java.util.UUID;
+
-/**
- * 功能 : 上传文件工具类
- * 创建人 : 慌途L
- */
@Slf4j
public class FileUtils {
public static String upLoadFile(MultipartFile file, String path) {
-
- if(file.isEmpty()){
+ if (file == null || file.isEmpty()) {
log.info("文件为空！");
return null;
}
+
String fileName = file.getOriginalFilename();
- int size = (int) file.getSize();
- log.info(fileName + "-->" + size);
-
- // 取得文件的后缀名。
- String ext = fileName.substring(fileName.lastIndexOf(".") + 1).toUpperCase();
-
- String newFileName =
- System.currentTimeMillis() / 1000 + new Random().nextInt(100000)+"." + ext;
+ log.info("上传文件: {} - 大小: {}", fileName, file.getSize());
- //String path = "F:/test" ;
- File dest = new File(path + "/" + newFileName);
- if(!dest.getParentFile().exists()){ //判断文件父目录是否存在
- dest.getParentFile().mkdir();
+ String ext = getFileExtension(fileName);
+ String newFileName = generateUniqueFileName(ext);
+
+ return saveFile(file, path, newFileName);
+ }
+
+ private static String getFileExtension(String fileName) {
+ return fileName.substring(fileName.lastIndexOf(".") + 1).toUpperCase();
+ }
+
+ private static String generateUniqueFileName(String ext) {
+ return UUID.randomUUID().toString() + "." + ext;
+ }
+
+ private static String saveFile(MultipartFile file, String path, String newFileName) {
+ File dest = new File(path, newFileName);
+ if (!dest.getParentFile().exists()) {
+ dest.getParentFile().mkdirs();
}
+
try {
- file.transferTo(dest); //保存文件
+ file.transferTo(dest);
return newFileName;
- } catch (IllegalStateException e) {
- // TODO Auto-generated catch block
- e.printStackTrace();
- return null;
} catch (IOException e) {
- // TODO Auto-generated catch block
- e.printStackTrace();
+ log.error("文件保存失败", e);
return null;
}
}
}
-
diff --git a/src/main/java/top/whgojp/modules/xss/controller/JsonpController.java b/src/main/java/top/whgojp/modules/xss/controller/JsonpController.java
new file mode 100644
index 0000000..3c4a30f
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/controller/JsonpController.java
@@ -0,0 +1,17 @@
+package top.whgojp.modules.xss.controller;
+
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/xss")
+public class JsonpController {
+
+ @GetMapping("/jsonp")
+ public String handleJsonp(@RequestParam String callback) {
+ // 故意不验证callback参数，直接拼接返回
+ return callback + "(" + "{\"message\": \"Hello from JSONP\"}" + ");";
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/OtherController.java b/src/main/java/top/whgojp/modules/xss/controller/OtherController.java
index ffc2778..727ce23 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/OtherController.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/OtherController.java
@@ -124,12 +124,12 @@ public R vul1Upload(@RequestParam("file") MultipartFile file,
}
@ApiOperation(value = "漏洞场景：模版引擎解析导致存储XSS", notes = "")
@GetMapping("/vul2OtherTemplate")
- public String vul2OtherTemplate(@RequestParam("content") String content,
+ public String vul2OtherTemplate(@RequestParam("payload") String payload,
@RequestParam("type") String type, Model model) {
if ("html".equals(type)) {
- model.addAttribute("html", content);
+ model.addAttribute("html", payload);
} else if ("text".equals(type)) {
- model.addAttribute("text", content);
+ model.addAttribute("text", payload);
}
return "vul/xss/other";
}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/PostMessageController.java b/src/main/java/top/whgojp/modules/xss/controller/PostMessageController.java
new file mode 100644
index 0000000..e5d8e82
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/controller/PostMessageController.java
@@ -0,0 +1,20 @@
+package top.whgojp.modules.xss.controller;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+@Controller
+@RequestMapping("/xss/postmessage")
+public class PostMessageController {
+
+ @GetMapping("/sender")
+ public String sender() {
+ return "vul/xss/postmessage/sender";
+ }
+
+ @GetMapping("/receiver")
+ public String receiver() {
+ return "vul/xss/postmessage/receiver";
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/ReflectController.java b/src/main/java/top/whgojp/modules/xss/controller/ReflectController.java
index 2e0b7de..7df5caf 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/ReflectController.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/ReflectController.java
@@ -12,11 +12,11 @@
import org.thymeleaf.util.StringUtils;
import top.whgojp.common.utils.CheckUserInput;
import top.whgojp.common.utils.R;
+import top.whgojp.modules.xss.controller.base.XssBaseController;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpUtils;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -27,43 +27,35 @@
* @Date: 2024/5/20 16:55
*/
@Slf4j
-@Api(value = "ReflectController", tags = "跨站脚本-反射型XSS")
+@Api(value = "ReflectController", tags = "跨站脚本 - 反射型XSS")
@Controller
@CrossOrigin(origins = "*")
@RequestMapping("/xss/reflect")
-public class ReflectController {
+public class ReflectController extends XssBaseController {
+
@Autowired
private CheckUserInput checkUserInput;
- @RequestMapping("")
- public String xssReflect() {
- return "vul/xss/reflect";
- }
- @RequestMapping("/vul")
- public String xssReflectVul() {
- return "vul/xss/reflect-vul";
- }
- @RequestMapping("/safe")
- public String xssReflectSafe() {
- return "vul/xss/reflect-safe";
- }
+ @RequestMapping("/{view}")
+ public String reflect(@PathVariable String view) {
+ return isValidView(view) ? "vul/xss/reflect/" + view : "error/404";
+ }
@ApiOperation(value = "漏洞场景：GET型与POST型", notes = "原生漏洞场景,未加任何过滤，Controller接口返回Json类型结果")
@RequestMapping("/vul1")
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public R vul1(@ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content) {
- log.info("反射型XSS：" + content);
- return R.ok(content);
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public R vul1(@ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload) {
+ return handleXssPayload(payload, "反射型-GET/POST型", false);
}
@ApiOperation(value = "漏洞场景：String", notes = "原生漏洞场景,未加任何过滤，Controller接口返回String")
@GetMapping("/vul2")
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public String vul2(@ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content) {
-
- return content;
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public String vul2(@ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload) {
+ log.info("[+]XSS-反射型-String型：" + payload);
+ return payload;
}
@SneakyThrows
@@ -72,19 +64,19 @@ public String vul2(@ApiParam(name = "content", value = "请求参数", required
@ResponseBody
@ApiImplicitParams({
@ApiImplicitParam(name = "type", value = "类型", dataType = "String", paramType = "query", dataTypeClass = String.class),
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
})
- public void vul3(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content, HttpServletResponse response) {
+ public void vul3(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload, HttpServletResponse response) {
switch (type) {
case "html":
- response.getWriter().print(content);
- log.info("反射型XSS，Content-Type：text/html;charset=utf-8：" + content);
+ response.getWriter().print(payload);
+ log.info("[+]XSS-反射性-Content-Type：text/html;charset=utf-8：" + payload);
response.setContentType("text/html;charset=utf-8");
response.getWriter().flush();
break;
case "plain":
- log.info("反射型XSS，Content-Type：text/plain;charset=utf-8：" + content);
- response.getWriter().print(content);
+ log.info("[+]XSS-反射性-Content-Type：text/plain;charset=utf-8：" + payload);
+ response.getWriter().print(payload);
response.setContentType("text/plain;charset=utf-8"); // response默认返回Content-Type类型是text/plain
response.getWriter().flush();
break;
@@ -95,44 +87,51 @@ public void vul3(@ApiParam(name = "type", value = "类型", required = true) @Re
break;
}
}
+
private static final String WHITELIST_REGEX = "^[a-zA-Z0-9_\\s]+$";
private static final Pattern pattern = Pattern.compile(WHITELIST_REGEX);
@ApiOperation(value = "安全代码：用户输入验证和过滤", notes = "对用户输入的数据进行验证和过滤，确保不包含恶意代码。使用白名单过滤，只允许特定类型的输入，如纯文本或指定格式的数据")
- @RequestMapping("/safe1")
+ @GetMapping("/safe1")
@ResponseBody
@ApiImplicitParams({
@ApiImplicitParam(name = "type", value = "类型", dataType = "String", paramType = "query", dataTypeClass = String.class),
@ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
})
- public R safe1(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content) {
+ public R safe1(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload) {
String filterContented = "";
switch (type) {
case "frontEnd":
- filterContented = content; // 前端过滤后传递过来 后端未进行处理(同样存在安全问题)
+ log.info("[-]XSS-反射性-前端白名单过滤：" + payload);
+ filterContented = payload; // 前端过滤后传递过来 后端未进行处理(同样存在安全问题)
break;
case "backEnd":
- Matcher matcher = pattern.matcher(content);
- if (matcher.matches()){
- return R.ok(content);
- }else return R.error("输入内容包含非法字符，请检查输入");
+ log.info("[-]XSS-反射性-后端白名单过滤：" + payload);
+ Matcher matcher = pattern.matcher(payload);
+ if (matcher.matches()) {
+ return R.ok(payload);
+ } else return R.error("输入内容包含非法字符，请检查输入");
}
return R.ok(filterContented);
}
+
@ApiOperation(value = "安全代码：内容安全策略-CSP防护", notes = "内容安全策略（Content Security Policy）是一种由浏览器实施的安全机制，旨在减少和防范跨站脚本攻击（XSS）等安全威胁。它通过允许网站管理员定义哪些内容来源是可信任的，从而防止恶意内容的加载和执行")
- @RequestMapping("/safe2")
+ @GetMapping("/safe2")
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public String safe2(@ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content,HttpServletResponse response) {
- response.setHeader("Content-Security-Policy","default-src self");
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public String safe2(@ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload, HttpServletResponse response) {
+ response.setHeader("Content-Security-Policy", "default-src self");
response.setHeader("Content-Security-Policy-Report-Only", "default-src 'self'; other-uri /xss/reflect/csp-other-endpoint");
- return content;
+ log.info("[-]XSS-反射性-内容安全策略-CSP防护：" + payload);
+ return payload;
}
+
@GetMapping("/a-safe2-CSP-front")
- public String safeCSPFront(){
+ public String safeCSPFront() {
return "vul/xss/csp-protect";
}
+
@PostMapping("/csp-report-endpoint")
public void receiveCSPReport(@RequestBody String reportData) {
// 获取当前时间
@@ -152,27 +151,30 @@ public void receiveCSPReport(@RequestBody String reportData) {
// System.err.println("Error writing CSP violation other to file: " + e.getMessage());
// }
}
+
@ApiOperation(value = "安全代码：特殊字符实体转义", notes = "特殊字符实体转义是一种将 HTML 中的特殊字符转换为预定义实体表示的过程。这种转义是为了确保在 HTML 页面中正确显示特定字符，同时避免它们被浏览器误解为 HTML 标签或JavaScript代码的一部分，从而导致页面结构混乱或安全漏洞。")
- @RequestMapping("/safe3")
+ @GetMapping("/safe3")
@ResponseBody
@ApiImplicitParams({
@ApiImplicitParam(name = "type", value = "类型", dataType = "String", paramType = "query", dataTypeClass = String.class),
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
})
- public R safe3(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content) {
+ public R safe3(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload) {
String filterContented = "";
- switch (type){
+ switch (type) {
case "manual":
- content = StringUtils.replace(content, "&", "&");
- content = StringUtils.replace(content, "<", "<");
- content = StringUtils.replace(content, ">", ">");
- content = StringUtils.replace(content, "\"", """);
- content = StringUtils.replace(content, "'", "'");
- content = StringUtils.replace(content, "/", "/");
- filterContented = content;
+ payload = StringUtils.replace(payload, "&", "&");
+ payload = StringUtils.replace(payload, "<", "<");
+ payload = StringUtils.replace(payload, ">", ">");
+ payload = StringUtils.replace(payload, "\"", """);
+ payload = StringUtils.replace(payload, "'", "'");
+ payload = StringUtils.replace(payload, "/", "/");
+ filterContented = payload;
+ log.info("[-]XSS-反射性-内容安全策略-CSP防护-原生实体转移：" + payload);
break;
case "spring":
- filterContented = HtmlUtils.htmlEscape(content);
+ filterContented = HtmlUtils.htmlEscape(payload);
+ log.info("[-]XSS-反射性-内容安全策略-CSP防护-Spring框架：" + payload);
break;
default:
return R.error("参数输入有误！");
@@ -183,8 +185,8 @@ public R safe3(@ApiParam(name = "type", value = "类型", required = true) @Requ
@ApiOperation(value = "安全代码：HttpOnly配置", notes = "HttpOnly是HTTP响应头属性，用于增强Web应用程序安全性。它防止客户端脚本访问(只能通过http/https协议访问)带有HttpOnly标记的 cookie，从而减少跨站点脚本攻击（XSS）的风险。")
@RequestMapping(value = "/safe4", method = RequestMethod.GET)
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public R safe4(@ApiParam(name = "content", value = "请求参数", required = true) String content, HttpServletRequest request,HttpServletResponse response) {
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public R safe4(@ApiParam(name = "payload", value = "请求参数", required = true) String payload, HttpServletRequest request, HttpServletResponse response) {
Cookie cookie = request.getCookies()[0];
cookie.setHttpOnly(true); // 设置为 HttpOnly
@@ -192,6 +194,6 @@ public R safe4(@ApiParam(name = "content", value = "请求参数", required = tr
cookie.setPath("/");
response.addCookie(cookie);
- return R.ok("已设置httponly(有效期10分钟)，请打开控制台查看cookie属性："+content);
+ return R.ok("已设置httponly(有效期10分钟)，请打开控制台查看cookie属性：" + payload);
}
}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/StoreController.java b/src/main/java/top/whgojp/modules/xss/controller/StoreController.java
index a91f126..a4ecf20 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/StoreController.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/StoreController.java
@@ -46,13 +46,13 @@ public String xssStore() {
}
@ApiOperation(value = "漏洞场景：原生无过滤", notes = "原生漏洞场景,未加任何过滤，将用户输入存储到数据库中")
- @RequestMapping("/vul")
+ @PostMapping("/vul")
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public R vul(@ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content,HttpServletRequest request) {
- log.info("存储型XSS：" + content);
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public R vul(@ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload,HttpServletRequest request) {
+ log.info("[+]XSS-存储性-原生无过滤：" + payload);
String ua = request.getHeader("User-Agent");
- final int code = xssService.insertOne(content,ua);
+ final int code = xssService.insertOne(payload,ua);
if (code == 1) {
log.info("插入数据成功！");
return R.ok("插入数据成功！");
diff --git a/src/main/java/top/whgojp/modules/xss/controller/base/XssBaseController.java b/src/main/java/top/whgojp/modules/xss/controller/base/XssBaseController.java
new file mode 100644
index 0000000..4ad2018
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/controller/base/XssBaseController.java
@@ -0,0 +1,41 @@
+package top.whgojp.modules.xss.controller.base;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.thymeleaf.util.StringUtils;
+import top.whgojp.common.utils.CheckUserInput;
+import top.whgojp.common.utils.R;
+
+import javax.servlet.http.HttpServletRequest;
+
+@Slf4j
+public abstract class XssBaseController {
+ @Autowired
+ protected CheckUserInput checkUserInput;
+
+ protected R handleXssPayload(String payload, String type, boolean enableFilter) {
+ if (StringUtils.isEmpty(payload)) {
+ return R.error("参数不能为空");
+ }
+
+ log.info("[+]XSS-{}-收到payload：{}", type, payload);
+
+ if (enableFilter) {
+ String filteredPayload = checkUserInput.filter(payload);
+ log.info("[+]XSS-{}-过滤后：{}", type, filteredPayload);
+ return R.ok(filteredPayload);
+ }
+
+ return R.ok(payload);
+ }
+
+ protected String getUserAgent(HttpServletRequest request) {
+ String ua = request.getHeader("User-Agent");
+ return StringUtils.isEmpty(ua) ? "unknown" : ua;
+ }
+
+ protected boolean isValidView(String view) {
+ return !StringUtils.isEmpty(view) &&
+ (view.equals("vul") || view.equals("safe"));
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/service/impl/XssServiceImpl.java b/src/main/java/top/whgojp/modules/xss/service/impl/XssServiceImpl.java
index 034a024..164e309 100644
--- a/src/main/java/top/whgojp/modules/xss/service/impl/XssServiceImpl.java
+++ b/src/main/java/top/whgojp/modules/xss/service/impl/XssServiceImpl.java
@@ -8,7 +8,6 @@
import top.whgojp.modules.xss.service.XssService;
import top.whgojp.modules.xss.mapper.XssMapper;
import org.springframework.stereotype.Service;
-
import java.util.List;
/**
@@ -18,30 +17,42 @@
*/
@Slf4j
@Service
-public class XssServiceImpl extends ServiceImpl
- implements XssService{
+public class XssServiceImpl extends ServiceImpl implements XssService {
@Autowired
private XssMapper xssMapper;
@Override
public int insertOne(String content, String ua) {
- final int code = xssMapper.insertAll(content,ua,DateUtil.now());
- return code;
+ try {
+ log.info("插入XSS记录 - content: {}, ua: {}", content, ua);
+ final int code = xssMapper.insertAll(content,ua,DateUtil.now());
+ return code;
+ } catch (Exception e) {
+ log.error("插入XSS记录失败", e);
+ return 0;
+ }
}
@Override
public List selectAll() {
- List xssList = xssMapper.selectAll();
- return xssList;
+ try {
+ List xssList = xssMapper.selectAll();
+ return xssList;
+ } catch (Exception e) {
+ log.error("查询XSS记录失败", e);
+ return null;
+ }
}
@Override
public int deleteById(int id) {
- int i = xssMapper.deleteById(id);
- return i;
+ try {
+ log.info("删除XSS记录 - id: {}", id);
+ int i = xssMapper.deleteById(id);
+ return i;
+ } catch (Exception e) {
+ log.error("删除XSS记录失败 - id: {}", id, e);
+ return 0;
+ }
}
}
-
-
-
-
diff --git a/src/main/resources/application-dev.yml b/src/main/resources/application-dev.yml
index 999df61..da6b67f 100755
--- a/src/main/resources/application-dev.yml
+++ b/src/main/resources/application-dev.yml
@@ -1,28 +1,24 @@
spring:
datasource:
- type: com.zaxxer.hikari.HikariDataSource
+ type: com.alibaba.druid.pool.DruidDataSource
driver-class-name: com.mysql.cj.jdbc.Driver
username: root
password: QWE123qwe
url: jdbc:mysql://localhost:13306/JavaSecLab?characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=false&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=GMT%2B8&nullCatalogMeansCurrent=true&allowPublicKeyRetrieval=true&allowMultiQueries=true
druid:
- initial-size: 5
- min-idle: 5
- max-active: 20
- max-wait: 60000
- time-between-eviction-runs-millis: 60000
- min-evictable-idle-time-millis: 300000
- validation-query: SELECT 1 FROM DUAL
- test-while-idle: true
- test-on-borrow: false
- test-on-return: false
- pool-prepared-statements: true
- max-pool-prepared-statement-per-connection-size: 20
- filters: stat,log4j # wall 这里关闭sql防火墙
- connection-properties: druid.stat.mergeSql=true;druid.stat.slowSqlMillis=5000
- remove-abandoned: true
- remove-abandoned-timeout: 1800
- log-abandoned: true
+ initial-size: 5 # 初始化连接数
+ min-idle: 5 # 最小空闲连接数
+ max-active: 20 # 最大连接数
+ max-wait: 30000 # 获取连接的最大等待时间（单位：毫秒）
+ validation-query: SELECT 1 FROM DUAL # 用于验证连接是否可用的 SQL
+ test-while-idle: true # 是否在空闲时测试连接
+ time-between-eviction-runs-millis: 60000 # 空闲连接检测周期（单位：毫秒）
+ min-evictable-idle-time-millis: 300000 # 连接在池中最小空闲时间（单位：毫秒）
+ pool-prepared-statements: true # 是否缓存PreparedStatement
+ max-pool-prepared-statement-per-connection-size: 20 # 每个连接缓存的最大PreparedStatement数量
+ log-abandoned: true # 是否记录被丢弃的连接
+ remove-abandoned: true # 是否移除被丢弃的连接
+ remove-abandoned-timeout: 180 # 丢弃连接的超时时间（单位：秒）
web-stat-filter:
enabled: true
stat-view-servlet:
@@ -31,13 +27,23 @@ spring:
# login-username: admin
# login-password: admin
reset-enable: false
- # 防火墙配置
-# wall:
-# config:
-# multi-statement-allow: false
+ # 防火墙配置
+ # wall:
+ # config:
+ # multi-statement-allow: false
+
+ # JPA 配置（可选）
+ #spring:
+ jpa:
+ hibernate:
+ ddl-auto: update # 自动更新数据库表结构（生产环境建议改为 validate 或 none）
+ show-sql: true # 打印 SQL 日志
+ properties:
+ hibernate.format_sql: true # 格式化 SQL
+ hibernate.dialect: org.hibernate.dialect.MySQL8Dialect
+
+logging:
+ level:
+ root: INFO # 默认日志级别
+ com.alibaba.druid.pool: DEBUG # 启用 Druid 的 DEBUG 日志（排查数据库连接池问题时启用）
-# Hibernate 配置：将当前上下文策略设置为 Spring
-# jpa:
-# properties:
-# hibernate:
-# current_session_context_class: thread
\ No newline at end of file
diff --git a/src/main/resources/application-docker.yml b/src/main/resources/application-docker.yml
index c0151f3..840616e 100755
--- a/src/main/resources/application-docker.yml
+++ b/src/main/resources/application-docker.yml
@@ -5,25 +5,20 @@ spring:
username: root
password: QWE123qwe
url: jdbc:mysql://Container-MYSQL8:3306/JavaSecLab?characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=false&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=GMT%2B8&nullCatalogMeansCurrent=true&allowPublicKeyRetrieval=true&allowMultiQueries=true
-# url: jdbc:mysql://47.94.130.42:3306/JavaSecLab?characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=false&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=GMT%2B8&nullCatalogMeansCurrent=true&allowPublicKeyRetrieval=true&allowMultiQueries=true
druid:
- initial-size: 5
- min-idle: 5
- max-active: 20
- max-wait: 60000
- time-between-eviction-runs-millis: 60000
- min-evictable-idle-time-millis: 300000
- validation-query: SELECT 1 FROM DUAL
- test-while-idle: true
- test-on-borrow: false
- test-on-return: false
- pool-prepared-statements: true
- max-pool-prepared-statement-per-connection-size: 20
- filters: stat,log4j # wall 这里关闭sql防火墙
- connection-properties: druid.stat.mergeSql=true;druid.stat.slowSqlMillis=5000
- remove-abandoned: true
- remove-abandoned-timeout: 1800
- log-abandoned: true
+ initial-size: 5 # 初始化连接数
+ min-idle: 5 # 最小空闲连接数
+ max-active: 20 # 最大连接数
+ max-wait: 30000 # 获取连接的最大等待时间（单位：毫秒）
+ validation-query: SELECT 1 FROM DUAL # 用于验证连接是否可用的 SQL
+ test-while-idle: true # 是否在空闲时测试连接
+ time-between-eviction-runs-millis: 60000 # 空闲连接检测周期（单位：毫秒）
+ min-evictable-idle-time-millis: 300000 # 连接在池中最小空闲时间（单位：毫秒）
+ pool-prepared-statements: true # 是否缓存PreparedStatement
+ max-pool-prepared-statement-per-connection-size: 20 # 每个连接缓存的最大PreparedStatement数量
+ log-abandoned: true # 是否记录被丢弃的连接
+ remove-abandoned: true # 是否移除被丢弃的连接
+ remove-abandoned-timeout: 180 # 丢弃连接的超时时间（单位：秒）
web-stat-filter:
enabled: true
stat-view-servlet:
@@ -32,14 +27,22 @@ spring:
# login-username: admin
# login-password: admin
reset-enable: false
- # 防火墙配置
- # wall:
- # config:
- # multi-statement-allow: false
+ # 防火墙配置
+ # wall:
+ # config:
+ # multi-statement-allow: false
+ # JPA 配置（可选）
+ #spring:
jpa:
hibernate:
- ddl-auto: none
- database: mysql
- database-platform: org.hibernate.dialect.MySQLDialect
- show-sql: true
\ No newline at end of file
+ ddl-auto: update # 自动更新数据库表结构（生产环境建议改为 validate 或 none）
+ show-sql: true # 打印 SQL 日志
+ properties:
+ hibernate.format_sql: true # 格式化 SQL
+ hibernate.dialect: org.hibernate.dialect.MySQL8Dialect
+
+logging:
+ level:
+ root: INFO # 默认日志级别
+ com.alibaba.druid.pool: DEBUG # 启用 Druid 的 DEBUG 日志（排查数据库连接池问题时启用）
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 2b612c5..79061cb 100755
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -41,6 +41,7 @@ management:
web:
exposure:
include: '*'
+ exclude:
base-path: /sys/actuator
logging:
@@ -56,6 +57,7 @@ mybatis-plus:
# 关闭MP3.0自带的banner
banner: false
+
folder:
upload: /tmp/upload
static: /tmp/static
@@ -89,4 +91,9 @@ J2FhZOq2OdVaWGKwW9BEcnx1QjMSZgciYR9anFyX4haMlDUdSBQYt0FwfRFfzARd
hGUahXhPvN1OkI+772dFhjpQYxf02oKrdW/pNrTAoYyE9tCUUeZngUZ6SkN+TlJa
ouK1o4xnmMD2YhHhzmxyn8wlLB8KopMzCQ8WaooivlJbyXQVp6bq9UFaeQW0NtIB
tzMFGyiO+DvR4pO52uQLEBU=
------END PRIVATE KEY-----"
\ No newline at end of file
+-----END PRIVATE KEY-----"
+
+jwt:
+ key: f3a4c6d5b9bfeff28b1f529b0840134bcd4183474e2d4a97c05615a134e4f4da
+
+#debug: true
\ No newline at end of file
diff --git a/src/main/resources/banner.txt b/src/main/resources/banner.txt
index cf6c02b..79d4bf5 100755
--- a/src/main/resources/banner.txt
+++ b/src/main/resources/banner.txt
@@ -1,5 +1,8 @@
====================================================================================================================
-
- Powered By whgojp
+ __ _____ __ __
+ / /___ __ ______ _/ ___/___ _____/ / ____ _/ /_
+ __ / / __ `/ | / / __ `/\__ \/ _ \/ ___/ / / __ `/ __ \
+ / /_/ / /_/ /| |/ / /_/ /___/ / __/ /__/ /___/ /_/ / /_/ /
+ \____/\__,_/ |___/\__,_//____/\___/\___/_____/\__,_/_.___/
====================================================================================================================
\ No newline at end of file
diff --git a/src/main/resources/static/api/init.json b/src/main/resources/static/api/init.json
index d7f58fe..5b85259 100644
--- a/src/main/resources/static/api/init.json
+++ b/src/main/resources/static/api/init.json
@@ -477,6 +477,7 @@
}
]
}
+
]
}
]
diff --git a/src/main/resources/static/images/vul/jdbc/jdbc.png b/src/main/resources/static/images/vul/jdbc/jdbc.png
new file mode 100644
index 0000000000000000000000000000000000000000..a4cf54f62c047eaf4a574797c1f038823b97265b
GIT binary patch
literal 152497
zcmeFZXH=8v7C*|2qs$B{=Ntkls`XNLM
zU4js40c9wmMF;_D2}(i?5CRDhLP`G5i*xR}cdh&F-jC;9x(HcM+0TCV{_Xnm^fzmZ
zeLo-jSxii9pXKFCwqj!9L@}`+WPjWPzL}DZsSp!8E@pY@!j0(sg{i0^pBBm{yb<_mh=))>rF&?Hy8)syIu57v7V=>ch53-;ZjOi!Fo?h$bTk6pTb=e
z;nxdrmy=WuDm$y)R{C`Q_e-vsY$L`b4E6m_|4|%Y99SG+wlgn(LK`rfjXsH!2AX->
z1t%=gig0I$6zDUZ@4;&s2{^<~>rmd+^Il<&pF-mGl1eS^E>qiEOyqeytT_sU0hGRtRi
zeXYRY4d?tgd*sE0Qs*hn(7P)JUC#A!&KnyWwxx$H(_Jc2IwchY9oe4YpJw)C@0-nx
z2;inWdZcByY?K*nR6&A#SQ3)$Hkq*oFGs?1mMfP&W29xMnTu27C0EC3r5dl_c^t**
zU;p%XzVBE0ucR`HYSai>d!51kp9G^(OG=1O|tgazSDQcll_<5ILDMW}A%sRHB
zx7#<#{>?-uLwg_FS_tXp}B5`U0~mvL&K@v1y1FD$5BvRjoOs`gdiDONzBjrn+hI
zpF6iaMGKC&0Oq2#MeYH!>)v++xVSI9NHlrCSf|cKeHDW!qxhG+0`!aJAKc;dz4aE+
z7L5BuUO2NbrIk;7N<6vkQg%9V@8131V;^sNY|fVR+F`4^8ot1@qYMv&iEWlUkRqA4W{1xbqB&o
zGl1U$23Eu$Yx32n5d`%MG&~I6)Z}TjZ|{EkN`DC>7w=Z!Dg4+v7cK+l-Jfxo4~Kp}
zn*AJVKMC8UR=LQ7)
z+j(UUWI*s~6B9k5(6EY{2qR~Q3}l-|U6hNZFI!u2ezBV)8WHvF^IQ+zFL#6$o^QsY8gY6rN*d>zG_BFMVQbWU
zf?&8};!PE~W@m1@BG}XYl|8ETuvv-MoAYm7*$ZPWdg5#H-L325B2B>j*xY`f5-;_i
zq}<{Xs3I>;e-l-d68PyY;oJ86Unz=<-6RIo^*+-XSMDu5olf;nqq-E4Yrg&!Szh37
z6vf0Nx7!8l*f?XaS2G1E;lCmRvTl@jt$p$-?+XtTdhjdVS~NrAy5@QFt-OGvZo2v*
zOz1B4k3kH%I_~tU;EGSra$2dwMnKlehzk17TU;}V@}!Ys5=G6%iin;)?)a%JpH~fc
zJSDe3xau+Hc#bk;FIdFH-2~A_L0JA*KeOwFC3q!YEdC_6fpvhzVx#e4kkxDc*Ulaz
zpTboSBu663veY=`v(w&M4_oT2^d^qx1s9dLc)!Nye)!LVJ41C8souK96PZpd#-1hH
zkqc5XRCOh1vCX$;UQ{DluOxj*UnMj)g)jJ6blt_(e9arZH#s%Q>8Vz4aZ!P@@5Gf{
z1dm`y{r6Qg^u5n$^gjQ}es;~Giz|&yP;0kP
zru+6@^^AZgY)2)iyK1!D^%xKb6fMO;N)`U7hUH*h;=-zSRI8;HnQlHMF_A(%tgqj5
z+ab4Kp!~Qsz&S)mw3NGAdeF=xVc<81eR30|X%ibO`g`|`CxpdHshFups#>l|@{@P@
z54PSXH*r5L4KK(no%Rsb2XJ%snpLXf$pN9%N6fxn14t(@*8l*urAOSwp*!t*E%^?r
zeoCbWi8pEs6oJ4#-Y6?|363W=tyP<5z}A;6xc$|l?dHRD-zs*0fQD1r1L_rmsHe{P
zPnaLJ$;;C;vX|Q4v)=Glu%N|TjaRE#1lVr&n!I(Xw8un%_2!bv_>xvQd3M&2!Wrd6T?h$B+bX9j=G+4
z&vGyl{Ec7pnW!RGcwQ$R%FC8r%LxgTCQ_YUP}=}q=m+Fmbd${$O0|3t2gXo<`8tS<*7Wl?b{*G@KkmP;g-Ivbq=v)d$g?8?3HA=S8=17JeT
zX(f1T$dT7z6K5J5B^hOSWz^~1Z@toIJkT$5TD($HuhH$~MS*hfd?yxU4}w|K&i)0E
zu;0}b3TIt;7Ok5~4WApOjY5S4#L4QWJMcusaumfV{g!gf)}X9ltIo5}&li)Mq%kqh
z(g*X}{!<9xUhHrsJJlEk+nRz6BqKK|+QoUi1mSzCzemF2Zwa4eOW=pa%bKWI(Rmp3iXlSqk7`{_
ziJI57AaRsLTsr{`xirY!Du4tkUkw86H>a-wM>7daFinLuzEWT!i72=L&oQV~U@q=a
z5VxrH<=;J}bjnB;vLpZ9&=BrC`w+IJ6*G+yH_Z9+@pOb#-ULUKffSU!onUW`!q!P)
z2stp}ucn-xLl!lKwCc@x9Vpm0$SN8zdS`<3)r9dZ_$6a!d}q+cFPCecPOdQWct-LY
zEe1x=**?ZYNZIyMv)NZ4CZJ*m29zR;rh=mktw(c%QDcNC6~<%)UAb4&##rbbyuOvq
zTvPMZ(tN
z!8_kD@_rG7kz#7cjIf`wV50Wco|PL4Y@8K3Jbd24NK!j=#zcIU9V16=(tsFVG#1!D
zivJO8s&)%f&70Rh)y9Sd3+MF0XzqL|a;wJ9@Wj`%?+}uNJ~G^11yDoTtlMEXP@2;_{>E_wEN8
z;1loTzT`FWM)3<6KF{V^Dswbp8RpGdY~dvYgGFxol|~qXpKXIs0P%iPzNZpDIl?;q
z1npm68_)5!_9Tz8PKNGOQquTCkEO??p0KGr{}4Q^Lv$$#ZIK_2AI
zds;h8iN=ezqqrTUxKi>t%*^|O1A+z^0rtwS5*?5km7uedK~21JG7E#bIH9r42@=%M
zn#y187HDnvrHX!qf{lU{NY&JCp90W)e>Vrinar#95UpBw>A(CuXinu%(1`N!OCKs+
z2gxjbrAlNw%YeZM(O-$!=F4AxtYnn)^==d9Q&wpy%eo6JBzE}R4zs4OSy}mndsmRp
zrMyuM0+D!R}r9@bZ6mjcS*q9CJb~amr?cx
z>U)i(wtjk+@(hj`PoD>5wmmKFqdbtb(yjG@jLJ7Uu2|e04>j<>i32mj5G0rIEj7-b@
z*7cf$(Tli073}(-UBmA;0U9wq7W{6pvqQ(sR2<<@VJ&)04!v`|NeDIKePrstEm@*d;=7=a~J
ztMw{A`V184IOGKarK7NpbipSEo(7r(sYpAl$t?@1I`g)r@(G?z=L$+&j8fOv39BVO
z0s|=$VxS{9FkCG)h?eGVvpCSWuO!?MP%8H3&-`#pYGAg(*)gkHdmqYq6BCMp6yueh
zmfcLHqL08Z!>UV}F*!E1U63fYA9FU=ea
zLN)n1Sn<9Yy)fIg+CK3h+F7$@&~Pg`gL9Y>zuNNxe}m9;a1*C+kZ!3t};2C^a(7ziSrImKIdbZcBMs0x+=jJ;ZTt7TkS`!y?ssBgV&;*sL*n0e%Nqc
z0@=U%L_SWNPphpYpWE4T_K#DaEu*^nQDT?zBEQFcW2AKIIf|k
zh4xTnm72!q-u&!&{ov8pB;#TS469OGh-z#g2H^O?S)X|VnMNAvHlaw842*zPEJXR+&;*2v}ZDeJn^L;l%*_14XO
z!S%kyodJ|9r}EefM+3ZH4qDq54{~RLJqge7sm+Rvy_ev$HXgzrpiScDS<;EV!q45V
z*KgQ)5>A;hoHfXaQq+(tJZ&Qx+xLixP2k$}$TYBB@yr>d@aaD~oHlcYsA`5o{DraK
zuDg*`Xn#t)#KkX5tGCDod&!a-?N4Jl7%A9QzU?jaP{-k_QTE$9y_LYzk~-b1iCs?$
zsEy)Ntt||0P4KN|)22wdziT9V%@sMiZ*YgRE2C#qWLsne_8JBnst$VxhP1Rc#b69VQK6SNPg99ZlUS!(y*2I2weJYbkoI`&IM6xZ{K~3Ar;P%q1!Ae5k+g=OYsro4q=lG7FR@A&W>$w2u5hJB{Og8tg8zYy
zKZjGIo`BUlr7PR7%wGWkrUPJ}CMB?BFjtwNl*it?>Oi(L36+9T0+}GBtPJ&Gyr;UH
zT=h?5`4}Zfg6l`$0sr3G9VGr{qqEC|azN+D=&6Iq^MzOWU4)i|&cN>s})(e=UoG_uB*j}A`F_G@=Y@?IWA8CFn
z&+l!|f^oRRDs=Q^(jPD7XeV_?X_{6=zhbL*m{w
z2hHDL-0`3FyK517{`z3jeeqZ1%LZ=;^(QK;5?u~r-i
zUWM#ylaLDlbHlN~>*T&b@;x;*H4%3rW6p(mwuT^u3@kNvlGNUq-EwkQ-hkoa_N;9Q
zwpVKWlu`-Kmq|6)T7*=($a`Q^Bc#4p+lB3W?e|O&o4-YM-UUYC?A2q*=8MhjMeSlK
z{%Ut?IpvJjxhd0?)d3C9Jl1wBcZJKcpeDMQC}R>DbQ^dz3&KvRlt$WQki-O??j6aV
zochPO-J1l)ZJ>EDOuIi4{dw8^ahGq^HIMRx%87k}mc_a31=#>PND;8ToUYU?53lwD
z$tfzQ1TtzYulEf2sn~`vuJFO2B;*PCh^I@VCl3$tB1=oE$q6DcJPR;J1mIyX=
zrP#Id8HiAo6Nk&q07j29`X=ssr(Z&8bnXe3R+{;V!R+O)8s*@Yvzs-N_6(BwwB*
z8Fr{u?-)<@mbxp6B|k5e&RSjYs6Onh^ILBs!9_)5Y4%#Bt+zc=U3JsH^sp9rMyo4F
z`OD^9R>jxy+06Htd`%}CWDCNUrUv2yB`a$@w-iAC-z%RFaP8WSYDHD9n%s}>7AEEa
zw~G}ye_K4E@fRJLA9yyLHZ+6>KD2w;beg?-I%Y0PVyT2y3{()hE6iMtd?Vh0IQ||p
ztU@|HjLkLYRNC9tlpTlsk7Vn5ZXP!JtavAu(>T`g?|P=nM5WcjBnC%8VB%*(UB6Zs
zL(Y;+-T@Wj1RTAc(Z3)Y;!`$eZ7Y*|q}twQp+Dng4*I-}&(G_MkVI_$II0RP7z!84
z3by!)0WRz?N*%dKzWYa4y|mq!fMQdmV~}vdWw+*4vfhf6D{1z-R)Hu0hZtn`?^rnzgR81Et%o9m?}zSzRcO=Fic-#z{W#)^?`h1229ZZV+d9-Ia$_bDR
zlj`^$2^Q({zr%av9NVFzh1E|Osh{PJdVgI=N_|H=ptps!VoyZ;y*(QU?dEjC`p!b^
zYdos%;p)nWPb4<5-VOzyqkQ>uR5Ao)QLS{yXL_|K7he#
zqK^?e(8tV^ZLsU7Re#7UD|Th?J>B`8*kAK%j6~j`$$_KqrWs>*S?E#?SF}H^?I-zi
zgUGX%q0`h>(kCy;!jS&Q70pXMV~L2I&qf5))2URAudR7FHBfuVUX%P6px~^kb)#ZP
zHeAKbRy}>Z){yOcn4b0JXnBPc$uo0QMXO6ilXuGEmNN|4_McepEoZjpNjY^hI_7**
zpu*;mjJ(ML;Skdkvw_P}3ZDe%)*cmS;)mA~(%b#4Q~J#(4eV~Hu;w{Q^Wl(gScDCo
zi~-P9)+)@Oz&bx4RWXCC>rEWm{~V9`Fr!l8Fk^ewe`B7Kkqj~iZ+?)8otco4Cw8|-
z$ws;YgSBsO%XGrUJdN&Q!W7!{4Sy-#HTjuwxT9@-s!6c;A+t1ujfo40s>P=7fP=x(
zaeXg-Z+1~s-SAh&*37!MxDXQw=q@YW3F5GwnZWH2K$KGhu?K>BPS6i!F7}taZq)m8ZMGP8j&oaIM|Jtc9jclof}jrNq>~
zOT(wK?$N>+8w*D;Zf{NsJ|@0s7OIc_H!|w8w8SU^SlheSyo6%`u-%w92|EN)o!RpW
zR+zLm&`{M9UEnElD|zKT%kg<3+*TWg(p+u7YWbcN)Y>Nkm*h&~heKb0YMybRuX`S}
zS5fw_%dDJrQ-sP?UsbXMhS&cuK)m-9*#Ey`4|TPyR>KtLJ%u9&#-rBsz`*+*LDZd!
z)~iy7a_3gRcolmMdrax;8)UqXmu~Z%tmPp36EZ?9>#C7d@$M+uoB?4?r*S+UOcD#T*hw860o5$1UQp*!
zNxnY&>8TFItPb^HUtaA-x}$eLyxNje79nfd`f)gR&Y5sKro;=HoAk#{Qts@YJ)693
z`RJ&PjZNEAS3`{&<`Ghs*NHeXssE$ZTOAPfeCq{3OL=z~WEV%RZe-|FYXp7xNS}!e
zFInUwCS;yH->*DBI>4}l7FPS^YP>N(52s6@(#dVqYt?Ou2PH4un?sa?S>89vs7%XK
zj~(P1%LD5)*VgL`)qEK@JR9Sqg!Bz|OgR7V3Ym~Id(TMsp?wPm|8X#0Kshd_XBd?p
zaT^n(hb6%VHxlvEWIw%P$#|3ayZV*Hi)chWAtGo{kFdEyj0
zHy3hiG+osNQId|=u2-Idqj3@I!~C*JM>u7qocjpYbVf9bC+IgZ-H#{UMqzCL=Wbep
zY&Q7WrUlef%Ke_-o+o>ZWZ}!oi3jVb7hMyJMCsL3I~ybt`Og)04xC`-ur1Wi4TDCG|u$$F(6
zM6WVNu>2b&W73dY`qoK}mJ_g*8Q8~vxPN;`P@X?VY1n`Vl-}AZJ(^VV@cCo^&jGsF
zc%Q|0t43o@u^}a|^4}s_P*N>l^ADQg*l9|dV|V&uA3vNq(7^4H(A3pMH!UKfsU(;b
zViVz>3Nkce`oTL%z6%KQga_8OHD>;$261yUHcTieVfLtMT)uvAY_0nM^k0@3%E*%P
z@%A=OHrJ9gUW)F)EnH3+!zHvg1{w!}8YNgwEa}-!t#LQ2pA+phU>bF`tPT`=^D|$(
zc+kAXkW#V)lh*44osk}bo~yP8lSIcDpp0}j+f(rJpGfp5R3mNsy$%$s)jVsA+hd;?
z$uj=Pa*igC!woV5e(^DKp!n-(#ITZhiH@xm|Kub(p)%#0o9-K5u7-9xmw=ldmv(|Nc+
zXVGNBOxRZ`5u3ymM=ppP%7XD?PJirVZ-2M19*$v5H{gnkiwN&MW|oj0e+liu`G&hnWFr$W8I}C
zRo4LFj&Ao7N@n^J?W~>A(Eq`~rx$mN>Vu4i?r0n3FZgi;52D~Rr*?z;6ubK+Q4x;Q
zKLrH!{^IIbKdA!o`us45F39eRC1EY0E4i*8#$(0IOn79c3YR@2=vx;r?kc5}HLRF1
z>CHTAoAgZQ4S8L{MqTzv%V1%rd(6sU0Xo-Trtz^Lu8cC*Fn379($kaHjFkp!I=NUu
z@|4u6t{1Nr(z+2#&M#rKCY>my_?o(I)#C}q^COkH*}OB}{7K&B;Em1#)>cCH6EwyVqxnwi1)m#dokNTV>>}Sq0;}bx1`b3<@{~>E-C48}Yd$D;wf|gxV
zQ)3V-8#Y&3LWgTKod(6sL#n8LqQT)Nhw`k4;$0bvSkacArlH|EU#21d_b~2YfJhs_
zPU&gLBec%l5t|#ur%FP}jv)iE^)^@!xQ|-I0#8FJKCb+8)#|*Dl}Rq
zCMK#~Ez`ei)ke(ER=AjGt9H$wlGd%TPQOtG+5@rzX@mfW6xT}o+SPOk-U0co8fOEj
zICDPzM#h$Z`qo^v(ErIR@P$m?%hN-nquCQe;hM}RQ|F@NIzY|rJ!7QQ(qa4=5()F$o1k|V*-wmlfA}ET3hwX9W`t`J#9Qz
z%dTP@SJ!`bO9=)koaQ8e%wNV$w%plsaNQ(4xKQ0Y6vHZ?@f
z32WKHF$vRIT<<_XJiEZi=Ba*qKvm2=-4N>1@2L%2C$r)0#jCtbh>)-5C|5A`a0``6
z4K!d@xJ57TZrC*98#9IFRgGtv`C%?9SszqfWN%bDKxV7Zp?sFGSr20h?M5p5Nx~sm
z|5Xo!nfMTJRmG-0>{t)QX0DC~$!2RM6+TnUv{sSazgC3DQy<(go@hJod8Wbp>Y3)d
zycZL|?6|IEK9Yg^5MFpd_6MvA?J!A#@93E+nwBMP?d{-;9TQ@em6d9>&@ZPV(F&8aD^Ij#oOAD5Mp-aQd^V_ry2E`u7is(vVqilSUOU+*nO7?T{F+3w$)@Uo^n$`g!v_H>k
zhuoNC7Rz{f-Am9kU)8G@+}B%-kF~k-FpzWZKk6GaFpYy3KxrniaAl~#_VG||
zvbkLB%3vI0Ljx)?KX<7dXI*v&mMr0#$MSdpj)OwdmHBH1y20~~$`eqxl#!lWlsh4Gd(}@*
zI%W?3@7mXDy?fPMG3B(S$IaZ_Q6E8KR_QxAV=(cJ*p5qErEO}834jSlk5X4J)lWrv
zo>J&Q|kk0WG7Ebq~zD`Q1)|*ga_Tq9h{;yKS}DIFs@$
zHRW`V&9BZV(1I3G?-A-(6~`zC%`;MwhW`O`+QPo=rDqs=7Nqc7d#0i$QBRj^tgcy`
zIVLnGs<{%3tKV(Z#ZYucy;sNU3ibo9SM2VkohYkhGL~7;Ae6w83h+~?$R-L)KgqnM
zL@CQZgu2-d%T)DT8ycQlwYGrdAll>GoVOE|px8G%Tb-beTrEMOTqyH}Qno1KaJT|Y
z_#Qi8mQ6U_>sVn`=fDmJ*)6gAQajBA(T{Oc1MBOTBH3}8lGLaW(+vw`rc2AL3xo6<
z3XW2jhB_R*&cqV!ooge55SyUW^M;`;lpvgb4c&v7#nMzMmn{j)pCGLE$MK5uG);AL
zuiW+#0E4U}j+Oq4H~RRU*}QB2Q+@nUK!I|RS_R1+TyiAf-m{yC00;#xaX!*`}wfD_-s`YpC_b*Ij$1XN&(Hhtz
z&t&wU$8s8t*pXVGqq4?v7M_lw67nO~P->nHD%oxcF#}C^15njYgZ5+|prCDN#|6{B
zK(@1sS$XkZPa`4hTa9{@10tcR@rmC0Wn%z-HT?objBURT#Z8uTXZUv65YjgPx
zjEa?&wT4*`XN$clgd{}Fho~TFlB1C@8x}+VEKUyA)igCl)eP2T!ecKS>es3kCGJ)C
z#1Mo+#VohGgJv;;a?dO+(s()o#4S5G(03G4x;C`{?P4B1MOM)1*ox6WvNp7fPuW&G
zl7sQ&Ky5n|JBDTqto=LH&AnI<4u2RY9jqGr!G
zO<9*yu9S~il}`-_KYuoEW8%R$~7kXhPA>>wlZuZ)Ni8JaTrv_T}Y7WBjE+*t~ef
z>BM3GRW(o3Oe%qJLnUi?F2e4M+MQjyvWDl)bc0_rhwWl7UA23VgzH~O
zH8Cw{;-I@PO4=}p1<89Q^|a2N6OHEXaq26hc;9)Qd#JbEV09Sd7JUIZV9=yd?&!P>
zsJ-6+We4uh3)~HzWkU`cJ&9lD|kCyOf6Qv}5$eox9
zXS=IKL!aBklG=vD(VtuTCzlIqCgVwKD8X6~pOsppVRc^Kfu
zS=F5*?AH@F1gAm^z
z$1YB5|Cx)Z>`wB~&Z%_Ww5vXZ65FG1nbp%bC&R>!W`pk}n>aOH#k@~5^QIai!x&gSNmqcBS`rBf=Wi
z!hbUnwE*&SyDFJu5@2ph0kpSA+e$b(Z7|Y>^cB8mkBR|2NPX9?gn~Ue65HEZ`O6jQ
zaX`yD&9fl$kZ;VH`wle!sIc|vpYun=UVFZ)FN;9EqFco=Sg0QybSN(F*?$tS
z`ld2uYQgCIKwput{VF%Be2&FhF4t~zE2Sh=I60dv)Ppuu{C}5TfR?^f*JGtO{$xs5
z->J}H{bJx7k70C2nWC|raR1<-TT`%ma1py%1%wEwao
z?H9=Hf}XRQm;TEl^T(GV)CSN07X2SjcLd>oBK1Fw+7X2R0m}bxc-o(A3RwE-a*IcS
zFP6jL5YAyAJ-TJON-TAY?T_~H=}9&PFGB#wLlHvuBhKYhhBn)Ud9B+UZfhpE^kDqJ
zP-qr=BDWzBXH}X3!Fb!zu6N*N0`s9c|AH>8Q@#@wUsX
zwK-$Kuz#>%AZ`&k9erFQ(L1ufuLP!(B|!=)nNrbRI}cf)`x(CiqjS^yhCO#7tR-$+
znkN{1*tIL>RhpHxE|+LyH7lV<^5&h&OWUCteFYk=I2@tbdbV$rV4D4eUs>gP!PH=^
zI~kkPCt5Oc9b!2_{X$}5zM8;t-A{YdY|DUcXJ3r@`Z=qj%ArdRTc8{^lbj*grcI?s
zx*mtF=)P6~uwrdTE6XwfSA{c3(@c3-b2@`D^B`_wL{l%}wx(!FHSdQVqj%)rkj3<^
zD7ylRVsw(|%UwCdos(C4?aTCz2~uSHC)b}6HN85n)v4Y|7f$_odPrINDq!`t4XOsNTXJdqqJc66Neu78}F$w7ybj4iN$UXL)JR~ddeQ|L~GM?PCW9QgoM(<1p<5h=g=
zG{skg3zHAg&C=dZn5``y?G4%52#gHmA3g#RYK~U@18lxFXNdMZGOHn+yS&&E5;G-7
zXGf-8)$n6VidO3b#}?Qc(BNl=jz4`Tre8_1L^+miwTcA4$!#oOL7_%cooHbKCm~xt
zm{dHbncUeas|1a|>kmn@evo|x?#;MG(bM@NCcqy+-F@^9DMkK&yvzY(7LwTd5h4z3I1M)6>VJL^qZ3@lofJlDhai
z6JE(
z6
zd^k(n6y6SQiC_NoGxz1?arTK={xe2YLO|HSn4jd1uuij|LbAc#*fykX48#Su1f8oU
z=<2UUH@VY?rV6$`w^C8+d3k=?x=Y7*^pX5KM29j*Lo|CCh}}8y{W6ktFE6t-H&YaH
z^T|Z5U;V)yskEdZ1kxAb;-K+}9a!KK%
zj$4FPwqP=0^Y(tZV?O$Bs&u#(@LsJ6D;?;C@v(2xd_QW3&zZc9`G;|Q&_lmk-yx%~
zf7!m$#6vejm7l`o>De&3y@txY$tKnipQl%LuJVe(-Mi15IL;FEYC>e3Bo~Kvi|L3C
z7A}OFMpL3sb*lfegT_=7hfxB0Fi
zuH8u*a+369%?5h9HGwN#+rUk%;m7ZeDIs^StZXzaR=13hddi}A-No(Q6ET~zchqFW
z|B!O;?T0BKp?+WMDRd2wUEM2joWU%JP><+)+dp&NnQysGt#t<3$eU_jUL2$h>upk>
zRb?vuN$OrQd!%%}@MC}&HEhZwYx~KbdAYm-b*Zh>Y4mze)cXjT$QBbR&tdDPx^p^>Q^DT;jaJtcSEUb(Y;GI&sz&U2Xjr+=@XUQJ
z=W16FWl1XJJR3P_Ma?T$IO?Vn_dQ4M=ExXpcN5}!=jC9c->vHd?^S~aBC%FO
zh^PC`$&56J9x%38NLV@(!zn^|C2??8k)A_D(Ym;6*zzNgg^_OczZ;6{>yU~XFYtf@oMuNRNOyE0!qL2;)qUUhb>
z&|MSzZs1?lgpuALc=5!M
zn~e-pw1JV`rMjz|ZyS4VeXy#UG(y!3l>QrHQ!sstXV@ToWjF6oFOP_SzPaexBTLI8
z)siA;v#MfCk&RO-NYSTI09(JxZEt3UH+4w}{=TFz8h=OAmwl)BvkD}UobSSVK+H~4
zQ`^hyepN2$ROiKPJ)OBOxO2Q!P|S*3DqFUChIKgvUH~pFH8)LY5BG?x$@ayti$}}t
z?1=%Jo6a7kq3hkpHzikUBd%)M*}*#vlYv#XetK_NtR(lAy>D=EPEm(S($)6n4S$%8
zXrSF=Eu(`}UXNpXo|vW%T#*8jO(%Chvnpz>BTdKDFHo#hSiY
zN>85^`suQ!7WsrhTi((Aqs907H1=x2@R1pVKn3TLr&JS99F-67=3tiN7+3Rf@v*9K
z)+%_T?mqu9lnKZWzk1bv&7?6mgto?e5XT&=j9VNn4x?nvl!PC*NjFz$SR5yYJI-&t
zv8OjM8=VupI%aPE#{BsH!hTtqz@_Wo=Tm!d-Qdlwrl?eg9^s9$QRLfXXGo+>;86Zj
zi8AM(^(3J=y>)XW4tQXQh2@u*b%RuRBq6alZs9R8FxRA|^Q)=w?<ox1nLPN=SYsVpbuEQS#^w^&f+~|up#=QEc}R(s`tLe1ABa109g$()z|xwf
zSy^dwHG~3G+?U5hD{Bnq>JQndGUJsc+r`G%Uo;4xdf!|r^Jm9LxL0rQYRgkid?h;Q
zr=4!y)ZHPK%;=OZ3G25%ARQkK-O+m}vbWCNlye%u3I%D#yg>dZ(^^Yhj2)V`&F&Y_
zlQURvrIoG8K|b>c^+XMI#~4Odf*kVpNs=i(mqIZNugaqA}F1$lm#$uYv}RA_Lyyk=()K8y5C4tqJ3;eI{tG0i87U#
z*|A_DM-+XUWIW+2l^BJY>Tx7!XV}DtsvMXp2{{hC?q1EdB#c)MaVVv8g~vvYI#7Li
zvlt{H+cntT3BUWjMrio=?PgMM!#+Q%bc?>F#9Z+Ay}h+p|LG9}@PfJXDYI9X$1aZ-
zn0FdJ(g#jK+vdxLL2!rpDP?s_j!MeMEC)ebNO)bOgoib0aI9Gmz@SF!5J|+R?PoSH
zN5#23QUG(7bdBkyXXO+6rB4uMd(g7nzK~+rvS#l)106f=WnTmH46~-of!9<1P)*%F
zWYfSbO--EwPM6?ebhcX|bq$Ddx3f{M0Y5)-zyzP=-ZVZ|-+{ddSacun1*B=I>PCBq
zOu}la?PxhVe>)mAyJ$T&iE{AuMa^=o%fqa7v8&?BKl8sNzw~Gw;F0)TN6&)ZT`(8x
zYDf8r?9G=F6M{M$8^(-$Uf+niFz!4+u#fW(o9mI!6)YYbMBjPt=*ebMMmJ(s>n_YP
z%lGaH5rw%pS5=+?zOt5)>ukPzW!zjR5&Sub1am7tK$n>QQMZC0#Hd+~izQ=J%p!Nj
zU~3#(ce
zWzFlhFpcIu%hPJw*2`$bDr}03%df($-6b{a1U&TQ
z3R?SEL9*#3-SdDNR!LLC>e{2p2-3#+1fc-9TVA6!J`=hju+RP4$B2F53R+~gTlg&_
zOB~LY@$tni4@6NmglvEyK-Vl$$+7mWTM;6Iwa^k=Amy>pdQREuB;;E}YgO5PFUIk3
zhx>gNR-7@(C0@h!zd@c(vIxFbTX)jSPX5aEPm)oYD;oi--61XUzX11bsL`Ywl5A#3
z?!dlL8xXs2hSsAMn3##~24+3?vn0hJ&O1lmZl
z4Y1|--Dt&f3CY4S1ET|Ed24&gAx=vsLl8?wf69BAZ@e~XNF4IlOPca1?lMF#ywzK5
ziy`gX6M>0M2>N?t{AX_6d5?p{;%jgMw+J1#^_bW<(0K3rgrgA!AYvLr-h6H$Owge<
z1esQ|xqm4U&;;#!fJt>n;YU%SI_-5^mxX5}@%
z%mecnBN+$5XB#XDFPC8K+3aIu3SLjzBdf!yE3@`UfIn{)<|#CA9x%KVMv_jTfm~pFnmLyRrrVn#d6Ogeh6KMPx0CrlZee<6Sx_{sBBtX
z^9JddbO3$mYUfTW^gjNV^mfoF>se$}K~_n6hS%M=BStMKtKwyh?x(kkmOkg}Xl2zz
zsy;01v8$Hr-bHGDp5+1a+?b}ig}tvzHocMXlYLe**99hGwaWB(rACqGWwD#aMs~9s
z^GaNXC$`_IJu5rWddv#)tW
zs@q%3*k(+Z9LEPtKuen%qDfQQ
z;4h&hpMMZFv-J6v+&DfxKDC1WRLOxiF1+=)eWv<}Sy~{~Z8o>OiZ>vgBaZ1N
z?6&^JzCbN17NAYos-TJcULvySGIxom;Ts%tE>CHLRc%~A<<1=4n^M@VvM|!z0i;<7BP7X$cbTyqck5Q<7U%UCy3V9K
zgy1*+r*HHVD8)3!L^LqPuf{~vu6V$V-T2Gq=!H)seT!2C5L5%Bj2c5@ks|(z)>K7>
zjO2WtZq}GzIg~F0G5WQK{OeG^2
zlTX$4s`ME$+*o^srWBQsT?LjH*RAs#Ef>dh-f6YJUo>8FQzFSBj#q1(VcNx>As%94
zf?PWHyq>2|zqkM;sPI%mj)KLAFhM2J8{`A$tFhhLNUsq&`jW&Adtgf8!3jB>Ndgq2
z_q>1jaIZ~t@8})HjEv+!+F;)`EV@T2IHzY}fz--3np1+YeFVNI1O`p{NstV3Kz4-l
z%IE(ub=6T(c3)RT#XvDgfgvTNLvjF7LX;4ZE@_b-8ir651f->;l$4fcr~#3N836(5
z7+`>*hZ^#`=&Qf)`NOqb%jMiScb~oYInRC4Bh#oXwEGuGab*)T)!4+h85(rkEwx(#gR`%6}zwHX19LeC%Mv7Pne0kXkq0n^bA8
ze(BYLx7J|$w`o43;}-pTFRaPj+<=L`8Vhi)XbMx?RuAUpY{m};u9M0e7_ez*VB1Fd
zPCQTK0S-Y6WZB}I_C>kK59X1|i5>6*V54>W){3b|ht`gD8fpM28|ns7z*~0WW&mo?
z3KCRMwf~*Y!#mN-0?Q>2)3q0}I(+3p==<(s&AozAS-39|x$2w}p6(n_KTo3VWKiz$S6t
z+MnoN6K}4HN?o~%)fa##R!E*~mpdDnt>U7%4)rtYXD(s+n|*g^5*G8DH^%v>HC=K&
zx$Te%>68k-J=5*uH2ZNPG;&emm&fkp`ImEMX&7W13|Q$HUrkEufC+O%pJd6y9%c_K
zV_~ERCeX>N;^%ss8SrdSrYcM7RCm8(-b{
zp7{7na>U$X@xgF*wiChJG~uI7#@JpnTmSR;6I0vs5F=7#Gcw$zGooizWq)GWPSRa(
zpJD-bIaC{16l-OQKyP&tTip#N%TXVcJ8xgYOHf-iTOG?)Id9L!n2Vd)ifJs4=wXjq
zP~nIm%6_YWCT_N-nj?-YAmt_C|e70LYqy^8tjvV{w{@IDF#%}BQG9x6#G#~b^ly(istYzd)^Y^
z!m)UlN#|ZJ8pQNysrsOGQL-YeY2`9#-+9WClPhyePQpcFcGB8NRVP2=VRCrVm{R4(
z?#LL;qnTKV()}eozL|7o?3ewVkcLKk;{*SLF%j%IRk05=!hTG5E+AZGZZ0va)H+)-
ze9BTo12(_LaI(n?5QA=2pW*JQrY4f}tyIg7k-LW`)%-E?{uAFDVfUwR}kf
z6qpI?MRneKf|e%+DL|NbPL4IH7jbeG;PS6ubQUgrT|E!S>GBI$?2m8c)dgxK&-%pV
z7KVpX+1(9R3XkFFMxIl75Sk{sw-L``B@#Zd)W_Z`$iKgCwloYSd^fT*arbTcm`9j;
ztcM@7bh{nuTA{R6;$<0`o7>Chv}=%)I|Bq4Vma*X=z3jq7n&Y<(b}XoGOvghoh>C6
za~V}R!JqUcHwx4vfVjR3()Zo)gTqHa5#?Y0Wv*iePNWwPZpMG`J$Nsq1sF657Wgrw
z5e*5BRtnm6bm;%gew0Bcw!Ol(+h%N0;iR#_&#fbdOf(2k;-1BuyXSgx
zRpvB_t>QwJ%4u3PRgah+*BQr7{0iLoF6q9nkvtf;&k-W83!G4$3=N9a7tRt5IYla_
zYxkwTn)^OAOw2aa>mVPY?|fProyW8Ptgz;Vn{M}p?HP}l+{LVi32BVm5U_)tMVt7#
zRo=OQ5lTT3H+U*$eVs|m=x!{HG=EG8@8$%FN*VCR2$Y^4o5lSH^Nlgk?cGHXmlj!F
za+DRN*o|WNygvp|7Od8uB=KQ+5b2?h_mX^ULV|!^rLZ9X${fS*89rhOj5aG4>3W3R
zL$oG_mb)7W2j_3+ZRUyB8OIE2>w*u
zZ%|_|PZhhC=ldZjA>7Op7dL@Tm%dA9Amf8I2qB;fE{nltcE{V3RU+%WS~i+_yMQZI
zZ1l39GbzZkPCU?%ex^OU8i5_pgzo-$Q?KzOV%9Y~o?zOiRs-@l9HIb$2~)Xh7Z>XMQCeElJAX)&qCPxK
z)rjs{!V0bQ-4HT>y%b&=o=xd_tFO=WvCSBUr#i^5Lz5pB#eo
z^p6a7p2n5}#YeL(X`4}Ps2AxuLU$R6?Pix(wf%QCUOko|WFNb$^VDT9M?4s(DySFj
zy3D)jG)PL}bWGGK=I&6nA_ijHvpO<_#|AqnB^g6%AQ9Ofv}5n)@g*W+sb-k
zV3P#66xO&xvB{RbzYBvkYAiX?8HG5bwP%xNx+|nW=D?<(Y>QjxHHRy|EW$bKnr97%
zx>>J1QdC12=B2KGG=2
z=pT>o@C0ygN@n4Dcs#(Glz@NGGDISJ-mYg|d37kwVMsj|HU4
zMY^{O-#Q-uM0RHZjegxEH(nMnl!hA1QSl^`;cj_AU7Bw4
z)Ke(xnxBRFxqZpi6sSB#nv3dp{mepV@JlDk`1;f^N3@ObOV2E#I#i41p{mAsP^Go7)oz7e;B1>No&$0l4hElhaOIM2+qiQO4Ff
z=_Vw-thL9gVCoX5Pc%LsET1J%{X2R^!Y3^qYgwvhmfLrLsOvthU39CRt1bXaG
z68Kp0JjYX(P|e`7=rq*NIkdS2E>7@KUK=Q60EGmv_a3=#=wTk=~2YKo2E22&W(gXUWw!2#4*aQ49|foB^e46FvsPSHOqd)Nc8D>
zOL62Xb@>SNB}zwEQ=z|{-C%ZV8uglZTJO;bH-zW-+I-*p?#?`@FBuCIc{Jzt`^+J-
zHfm+y5}s&w=q@G(x<2y~#QeeNi!CR#l{qNffU2MNwxLw4t==K~2{m)5hM5zqL}@aE
z+grexNN{%)Bf$)R&{!;3rs%OGEPY6LQRk9xMJAUeVcwz}%Hq4r_MaW#POyz
zVaA*i>n06u7G3``;T1?q>NG+0m@vnE8C3I+id$P-L-f7-we9MyShWl|A_P5w|EZh1
z0R$X$@7K!}LgQ0I@8#VOZ&^4x0T_1OrYv__F2^9YKL*)M3@CNJ0DT*v0Q~XcRW`*u
z8*uM|RncL!NItMcvP2FNB)Jnql_~~X@{s98BkUy}wF$FFe4TZ7wl2P^wPCs0EwF5{
z9)^T8B;?wl%wXGs2@-3T)QRJX3Ef5y^So66*L-MCXfG4TX0eA&Bt7eQxysFxU5NV-
zDnD$V030l*PEMT#QUM96*mYNHB4oPT>WMHq1hsbQeVf%^7?9^UxAQ}_C#=tjF~4vr
z@8B%Dy75!B`h@EoY%Yvfivq6^l&fl7g@5PuxjuEV)uali-!z&;&CIsLX|ej~oa#9r
z9Ss9|ni!w7bxmgVWf3FE`q842pEOw-6hlJWb33KZ#2Rxot(LC_T#_}1M1@P}{D1+S
zQ5Xn(;3&@snd7Yw-9u!dsA{aszW;%=+i2pU(`CZ^Z7epCR62!pX*4qJ)?8*_YDbZg
zyP?#fp3$#QtJ7n8z=s|j3n9!^V)09*ty&S3p)(*46Y3_$lg8qlWu@gGA&o2@b2?O0
zSLP~KdFB*=&0bk^g#F}N)3#)j&?)t!-BRjq46ZQw*QfN~b22NAqE#uuaMlkB1vB;2
zh-7|1PQP5WNPn3AFxS(z)^n@n;SMvWzgyjXx=E#e_U!QEv=>=JD?D8lJ27WSPFdPWpsNcF;>uP;N@bqisP-?!mH<9Rt}C#z_B@~zK#o(7m)00
zqdzzr(0BLYH1}BaQ11J7BJbpaIWon2+CNuXeSQ4n#A^K%J{TH>LB)qu$R5+N+IS?EZU8G48JB?h2eB?{*?7kDkEBQf}
zksA&4>-eXRE^WNlk@qQinVO-lts368b0d{AJ(Nb>3al-qRb^3^Z<+JZ;LKW=oUe|1
z+J}wS@Q&CYX$yOA0$7`=+zi#5!!NILfj)^r(26nkY|fV;GUBwt^D3zaW@Z0(fo&18czMTHXTe0*KYNcu!z*M9kNU$Lv67T7FY99|cz6BvK(A`h1cbRlUYezE4
z&Mm^%r{^tU>W~yWPy=b(NJr20u1ZA&T|V`70rX}6xfj6IV!H{vWtyO`_tEoG;hp2f
zK`absd)Z^QUnW=N=ng2hB}?cL{3j-&I(g_G*LW||iPR1PeXLUeL)Se)d-$TMEV@(i?@I4cnRLF+tkKVN*!zUfJTp#
zQ<1DUc*X;H+%f<$hfTd*K1lcd$}wmlk+NPaa=d>Q#lp#{0r4$K99hwBD@AW_3?E^z
z-__LBL-qF?*WuF`b;R0%YlR(00pvtcQeD>sImdN6W%4k$kH(;ftsP?^MQn-rOQr$~WsWFlaz+Jy*DXxs{hiTgj2ZO{8m_VBLHAcrr{hn)b80F7QN3Qgc%lp_d)C0|?L
z>N>+HGYbn=30E7mHg+cLjxXod^LW5t()&~v#r^l*G=
zyXsVSQseW8K~j2DBT?W+TY9*~1ha2yb8~tBu$F;~dHpU<#1cDXY2Q{%-o3GVgprG!
zo7vTqMifR@tMub$4-BO(SL^w9=u$dg5t?gZ?u^HiO0l&|3*hi*!O+%?5y45vWHv4TNQR|GsGSTDx(2zYD-;GwoSz277=7kx<2sv^J&e
zuF*w?CUL^?Pz`#r8g+oePdK5vPg678JH-;;aF&l)jf5%ZVfp<^@v7(%I$8_Y<>I^n
z!SUgokGVrRR|IkE!|FAHl7^OUH6wICUn*t@G$%Q!JimG>(h*Dx`myELD*F1?D7~yl)mJw<9jI|#|v`iQ{V&^-63R`AY+nOxv{X?
zbqjh+U6@&EWwi4axlZjFXn~`kyCKk1Q&Lguls8yFo!<_1bpA
zp~e(_lfaeW2U2^mtBk2Re)_WV`KUsk?Pci(RC0}&`x+mcYBFoGitjc}AYvNPH!tZB
zRZqmGxO00*GCOiJ{%OibskifG=Z_Ah>%Xa@4QFwkl-JlfvwkGbd?WP@Gfw#FjU^n#
zuDCTgLRFHwHukCwx9QqO;bTIdzqHNNOmLXaZC;y-I7*4=X?9^ubQ1GrL~|Bxef4si
ztKiSN82PUKL%WP2ygq)YJGJ*vM)to4qI;=bF5ooM{K>7OB_oB-+EPa*rlz4IB4R?I
z?=HXB&PuDJf&Sp(lE@XOdiOWESgjkmbVLwYCy$gIj_l2$+4l+BfpMH`#9J;@`(aLd
z6NgAL&nV~o2|4GNM6;Z8zJ+LU7*{8-dK@-)3xd7+-b~*J0dJSz$x^v`<5G@^rhMvU
zN~hXVsm6+Bjwr>|3XBi3ai;yWrWA!~&jI^-JcR7OCBGgSo?WJF7QdmxT8Nz%By)b(
zHa{)OLx8`6f9Cu7nEDxEn`d}%l|{gq>-J?!*sP^J#!lkh(36ns7mFuHj2Ms>9F)Gh
zP6BZw@04;am$XtCgzUHi2v)}hNb>U#=!e-jFvdmatE~&ZU`;LZQz!OZsnxU3UOd0K
z6Y!pAQ1`OUNQ%i|ijYg!S!==Fjd*Zk9QCV6G8D;jRP5xLqFilHnUfOg%z|v-
z_0?!!h^0m7``&+{^W(?0$q?QTKZKZN*}pt{A|GypGTle9NVsK+c?qkk7CrdP$43|5
z%B@-WPQcCejU(m^8D-)w*CFKHe@|Ps`a>QjCMMEn51QOl!a;8a{YD{*r@F>V-t6HD
zXRumH6*Uo&l7HHedgH04+VzHL>{LiA75>|!X+hR04+tWUj$R@TJ2WH6O_i1U+BW(T
z@vr*yXn0{*c90IoqXhtM`b~reS}5`B3<{>G5ZhKvGLlM}f|mymKW(dQ(-#
zo2wF1-ntPA6mki|cV*4rhWk~s{~ICQ)Bi^3sCKGT_C>>n6IU
z7m!9%Rey&CmjY)AoGVBKDe*KtWteY6+5KH+>laAR>ufcV536YUf{U$M&lHwxJvB_d
zJ@Bg~BOy8mqQ1cp%LAJL2(-K`oQ;|hb!Tr{sk3^@;nooU{Ku!lX
z<3L65gJx94bm4uLFq;XVFuCp#QBT+?eyaW6S^*_@NSQ(9P!&gefb#Y2mE-dj%T0<^HsbndwuMcEFw@GjFf
z7b=*uw&uR>{Q0&!KK3ovgDT*gEOpAIbK#HUE+5RZB`1j|vqd{P65C0tu$u|kzVx$9
z<*?ZMd2Q-zP)@=Bel&vP&laB79kKD*DCGfPY>7Z4zAv3My`<&vm@`3}JpD7`b=%A>
z*YbhutMkUQ&A25hb(PL8Md`YZyzQC?d4v1sjV3P
zgHNghsQiPV4y+_$Z;Bfo=&Mw0f7%RI7UWTm4wf5JYb
zRk%LY9gn;q%pclA4_?ggb|-
zR-DsF{5s}h2;9k_KP|@{067w(nu;}3~WEo
z`ilSLu5KD0`OO_i;$4K4s~3@JvX@eo6Am$^`k<27Fs=P2MN(ni3vQ9;!j_0RNIibH
zn`HG&vUIaCIRpB^)06HhUAx1)Lx6fVtgK>)?9#X&KRG!?>Bpw71oA9LSVZt8`q*vA
zzw}Lfj}ZZe(sqrVY)|hAa^01F#4V$3)~-CYFmJ2WM(2IAx>JU)WAJcM5#z+z;}OnP
z{@ID6tFJb0@F}Nl^}osEz)LfJE{o69`rxeprGG&%)A%RiH~h#iK`41CwULaC0ilW@
zX2~ncO%L<6DNKi$8P8avp0J0i1L)DZH+rEF0%63%=l*3MBrHTj-5PhO-g^3jOZD=yMDF)^QM-w
ztMzeI*COI#bx*Qja|yd?%kFwE_Gz^{g~bojfX46Ad%_kh?~Q$6U+2k&6`kvpYY)WW
z^{{U)rtj_wI~;~`Z_?k$;jXm(}0A35i1&&VW|yf>*>?is;49NkYbsOhsA9XU6W&{|cNiZhXlUll6*wfV=bg_~_H1;lAYnE{{TV^d#5`}Ic5krCRiyqocQZNfb3*GiZ`KF1
z9dCC#gECT5mn(Z&nfL`h&Fy^l#Wh8-R)pjGrym7#ANVXw
zo^YMtPgD4P7)Yp*``_`OD$!Hf(zxk{&j1&_1fOvQCjuOu%jAuHqOnl3!_Y(I`!(gc
z*{#p>N+isF7#6=*H%G!c2cof}?o*dyfX?P83w{|$-|N6iE^${gx9eFc|iw@%C@WXYJTy|(er}=;OKyWLJcW2Ymr~Kl4ChdPE!0iI@8tR72W0!&
z-;sD+`!BOF4ZaOiNwghNKap``lBjOK+NvsP24A>FQcmb+Mm*hOdmzV$9n6o6&3w+O{aH=Qs$q7#23!>YZ?4KeDV};XHKHa
zf5zVr-1$ycRD{dS8$oz*K|~UyE0M3^>_jj>hXyp#!{@I1watBZSCq3-Qx!J@@ftL|
z-LwNSo;WF8zYQ7Of0|S^EbrtEbavi4loWGQIJJU~vQtQEy^4f13(Q@MXBkL*gypV*R_^!PD``Rd{oRgT-6
zU#cdL2y6leF~GxB`Fb=fiCxH64f*C+^_BN$r4Skw6D8VE59rOj4l7lbgs19n(R{np
zuPw5kY57d=M-9;)Z(HKrt&9c3l~bW#tm7J|L?H?96|D7Mxs9uSHB|^U>us)!3CG~6
zznidbx%g-n1+ULfQ@!$oc>dka$VlZsnTFwErv8Ba!?ig*Z=ySG05y+l`HZ}CJ`5Kh
zG3rl^b&}ioRC`OuTCLZShq$|}UN@X@dq3gpDdvOIyjzU(NV3JvJaXghYtg)Z<-CJ_
zxNSD-=9&&yyteckOGf&&+9SW((oPE?=#Ze7dj(?IK-F|A)%=OUGNzcEe*kJA%aY&W
z_&3C;>HdV+Xu8b+roUXW7Re~aV6(Y@g@Wq>K5>F8Jq&+odAg`Ljy-%g8N{jp(h@||=aly$Uq&_d86K+&H+C8w$QC&knJrdrEeG7IF^hiWbl!aufv;ELFdSI@$G*{f=zGOOqDdmb)O>B#5xp**^
zWsqdQYH?pfOj;Z9ZbSRoX~MP6IVhl0UyV(pZnA-U$&O##gIu@;trqPFHs@zmx^OKt
ze)n(>5%gc4YnxAt&C=&?S3OpKJgiSUv;
zPqywz!d;&wtk3EZK5oc!k@k3xpi%3)NwP{O)*VOL{jDs2|Lao%R|+w(VQfZ|X1?dp
z4i=I>%pN;!N+-En=x0`^clv>|y
zd=S`f;Usbl-<)?mI^aE`4-N^Dc0KrLnKDyM-bw78oZ5VXtJ?eW^m>(<^YdkncFsDa
z=dNT4pC^1PZC0Y9r&2qOz*O6aJH}pVMFHTDRcf02S&pmqnjv$^ybWJ1ew(UuWu=Oz
zZh^$eP&DM+&Bcqma1eS7BZ(|t1^#Vsbn_q1pHA*+>UM;Ri_=xuslt}rV`F2XLEj4k
z#ZH|$?O&}ceVJ0$>LYcAF+AeMcUrZ?{{TKS~L$_p;#7di(?dUC=_~M^wsEDUx
zL;YLDe73}M;3=(Hs%ePA^Q61^f*U#%d6p`Tcqmt22BJP-uKE^?JFaS@wDQYwW88)C
zJjAlM9jgLk0@D-C_n(9DUelsK`pumV%wm}pN&(Z&D#Z`DT$l>yd-DWuH&o!Csx{i{9)y!T^Wiu+h<{^l51BrG&D(u_1)4c2aR`9gsca*
zdis|~;gZ+*Uf7Uq{Jbf026o(bxlKBP^Vfk*>*)^D>-Fnx&;dGV3#S*Up!I<^)9GVu
zV%PdwbGoy=v@EW3HF9+&(+MvXY@ymr88SH}yllVPP-=T-_V(`M;5I|6?B(*%4_r1(
zQck^xV(n_|iTL?>c85*v*n$!DB+-P-Csg3tRpA^6#uSyr2b_!eAJxo+1L5;LYlj0
z5l4Hhg(GBuZEZ#9)%=nplXruPk;7VG;l_bV0U!WilBLM#<~7<%z4J?h5@?kW|?
z0c7L}N(r?h<>NzaRSwr(Bd_4jq7(6pfYnJlQjbTWd-5u0`@I8l?(8e{Z$zCiW$F10TanE@*G}
z=7nrx*k29w?hkJzkgVE1Tx-$uPLhagty9ae{>WF+f~G$Rk2%4M9`1ovPBio2z}qRo
ziyz`55T10L*BGAY4Eu`OJ53=E1;<86uT!bZuYQhx^D_6H64hg%Hnt{?Zv^DF+xPXG
z4PhLcX9^eEovY!}1i-uH)-t35NDE+rwK`!}FZlD{1%seXyot#y=_
zB99^0C`sF)kH6!VkIzmeCzUjhpXzA>n;^;S{#lV@szN%!wJP%`6>!LGI4@H_Ea6$_
zZ9bBh$ZesipsiF+h8<|4{+=ihA+)K|+LnCz&MqT>oP%$IuwZ#-6j{d-2WN@zaKcX{
zesc+xsWn_Sog(W}+doQS_s5vqxHzseK_6jM6`%cNp11GH`75l-Bx_qmF#?|%`R;5p
z&_4<=R}-=qM+~SG9!?vu9=Go(CW$KS@7GZ8i0Ku0r6{u^=+WKpt0SPPJEAbIrV2Wa
zu++AmA>-&y(xtQHLGdSSJW@^#{I^dG=hOp<{>6Ow=Re7a8Ax&Nk*Hd{-RsMgmuKwX
zM1GEF{K+AcvVWhyFFT-&n7{y7R1L3Ut(8DCKI>+(zG~~9f#?EPz5Ax%#HzTJIM1=z
ztF^NZwn~DJj9NQqN+{X$j<~suhKNK%_OU+~xc0A_iF$H%z76rX5%ek(bL1z3nK^ZN
zP5~f!T1AVhXnwEbzfq~C{kKspF|I?Uyxn<4JFs<=(ZL@Ky#~|BRt19
zIMIIXIx4cI>08C92=}-qlP%OQ&-7-uWvWhkdVK3)eI2{gQly9$7HmWtu9vVsHl0#hL};4
zmT;?vm3_7|Iqh#SA$%*JZh4D7%+fD3acNpbkgb3yoUFOT<_@4ea
z?Pve_fEVR|q#gK^IqnZVn9mgC*(Wt~_cq|oMvq=%y+V|m3x^vk^FOAL3wn`?WyFXo
zdJZ2&I@p|!OnXbFA6PmlF$CY>YPU&omTGO}jOGZXK9JYBeZ|z5zSBsU>CDFcM&?Kd
zF*sLKi?U)Eq%#UlI(mtNN{G7l{>a~60CvvO7j~D{e{E0+X1xvk|D#IXKCu8J13&%`
z=ipyn(-H*-E7k8L!zj8!u7%uTpud!YokUncMO61^kqn00qEo-%d`e1!_wU4Ek3GF5
zvBNbd+72q^bSYL$z(+G>kUk<68DTn>c+quLIa;NLs3qRQ*J~>)ficB9>m6{RPP+*H
zFFUj4{u#t@OE*Z&dEri2V$BHR2j`Ld{+BF70)xO6i}T{Qh6tLT!#?kMpIkJ2WwUW@
zVSIV_!4=s~P_C+6&1ShVwWFyr#XB*6f7D;WLfO2kwJn7>+2E@5zBwgW@A(Bs$D~)J
z1-H&CB~eW-um#5pN+?+cy*0nGBY5-gIiWuK&9d7bSOdgaEmU<_e|maH{&bP?eZ}Ht
z(t0gae%6s6{H*g5q@2rF?6zsWN{JUy*jR{Fb5NY`Y2U9DB>qE~7J)2LmCT9OzU8_P
zGnWo8Zt@*|7UKaY!)793W^7AQeAre%XJ>AU_^=<7nMq-ta%UPK$)m^I_Zg$FKV{(k
z8!-Y)zuno$z}{kv&VaoVYz3Zj|1);nq0hvyLPkVNWcl=z=sh_^^MS{83hwv4d?;1L98&ecPyfi^r~j%RlXJ+|!Q!DE&6+66P7@~8VFyz9f6c|YS~
z9Cmx}1~W0TK8x*1?pRw&S|GIuLC=>n8^&#XTn*Lh
zQMvEAUD1XVr<2R$_xV(fOsp&J$KAfSj`AXO2a7`k)ag)GLB;{JJ
zKU40lu+V8n=tvua4*&8qA4di<=u_pnQLhyc#!1uwFdqk=5;DtH+CTxPa3d8dAU@i@zO`_FY3p$|S*u
zes|yA+B=f(RE|x`;0`@zL8tFsp#MSNfcN_%E>nGv_D{a`*exSVx@2LnF&?;NDIWbc
z4E&4xs1PHS5D;qoUYhSHQ#e7P>D$kW|HTby(w!6bV)heeAnGFCiNo#vs+PPvsjXJr
zzEiJ`dhK!DMD5&6x|%>D^URKM0;@reP-f4CEaG-`EI(Js{0GOK1L`nbWV?G3G-kHI
z?FP6yz25e{IrVo8E8wsB9^$C7mLHP7h5sf!DyeZ&foS{Uvhgg|2ssXdJYgj45VgYz
zIsue~(){2;?c_EaVGp2WEEJc<;dM}ob08lNPYk_6vWv4b5`u2(jC+bS0*kD7VT4}%
z%GoO)6YuAHa>?VBBqJFAZmRXbN`g?XNS6are
zZ%=A)YE5|PxVUrFgSf&C`xHIN$@oNGhdJM4&a|7jHn*MY`CQHIbB-{NTSv2lQahFg
zRUa&Y=}t^)Ze?5AZebwhDIw|cG@@0j`Nc=-tlCi~G9j0`zoPsd3DJKWj0N^S(x)IU
zz4iS0ndW8+RY?eTUBfXrm@FckA`G{&IG*l&Tm4xancDS`62f<#Fhi?ZVopj-B^OE4
zrxI}g2#eDe>b_9yZv3HzL#E>qH&d0twW_^hTe5?{(%BBu*x%C{2EdagB#`m#QIGS9#lO-
z&~x>fwSPE&XPO@fB&4|-Bz$c%-)dL-**9CZUKZ7q>}?$Sxm=U}L82DB^A@PO?0!e6
zTgBliH)x?Brsj)Dve7f_Waq;;cq-yW`S10;zosmBUr6QR>BHp-Qp2iX94IKtSP6a0
zu^v=3!*``VaWkr?{2N|O8$)GmCj{=jd&RON;n6FjqufB?c~;R^7v$t_6mQDkGt|oS
zgO@$RUOLG0bx+{sj&JU5Ie#>hU4&1by{tVfYTO`N`J`cUOPXzQ?ozzWajRw&77x)X
zA_tX(&Lbjf;QmClR}rSi3%<
zH9d;D1+I06YxtYGIbIbH24lUyTPQJUYY0zj1E=8aWe-qRC_TOx5T@eQ;Mn&%7)Bq>
zc3!)d{gIP;d~cNMxbp!_3%rAp%Xq7vG{Cn!#o~YHhfP6q*Oxv2i
zT;1Kmt!St>A^~7#)MPdo&7QdBS(E+fq{2WQ2_-G89I4&1qX#ZRBzmGcZhiks{pNlCJgsJG^-Rk%
zvlJqU*|XAzS9)@8&JX!S>@MYO(n&sO|Jbh|EV7aAyO>qb-QsFzpc-&G*6LbFB9{*B
z6en-Y)2B9$*<-!YL$p4fO!GTEkq^}=1c)7Zo+Dzt_*|`i6pkp@)Km7VblX7Hl)S|Axs!
zm&f;2e|WRi$LmZKr5DaREB`~f_s)ybcRs9i6ltci058T<>OPHhRG)zcukV
zKgSlmifiTbCxgX(y*&2DwDde~^WP88IQ_xSrWA~OnVV?7S6&>@w=6eS{4Q-EoWA87
zQfGU<_kBTmrzs34b7vL?QrsVdZf^K)BK)Z3oEcSotcEWa)CyU
zp>j6wJlH`1Xs1aVZ3Tk(q%JwP$=5hpaBsBC#J>W9?(7>m;#4xaxV}L-Z?`XTrqS_@
zNq4Gs3VfR@Cx!cu7xjB9RwDn97HwG4(WQ+miBYu`6>j(LK`v2uCD6?w?#gu~U59+r
z=x~^>j!>!5uTHYuFC+uaR|uam2wzJHi3xu+=#hX{KwHw@s+sh74Lcv82Ig2^9j%R_
z44N-JGZ|I8jZmnz=gk@4xp=l!z0Ig;BWAjqqvPe#xd49An3ezG>&@SlC4nV(h`xR0
z3GEuF?-BWQ=~oHKT=y05VVp-+N${e5xy~2HBM|S4aou`RwL3nqL5B(vXofj1S65rX
zvH=V3zBrC^iE(8y!m>;8@~hJxTrYb^Y3G0q`K1VdGdw{%
zw(+?e$Buqn+jmdkPtke0(lL5Z-6GGUG;U_vk*dU+e7qifC#8x0qo28)JxyQDs;Fd5
zxWLg)Jq(@7_IHB>hX3eCW9CG>c1>ZNvR)K8xA3ntN}@Ksqh!-KBks)lfpB#8rQyH?
zz=x0#mYo$Wzv&%kM5hPbediMhSkQ+t+i9Ydd?Um2ed@i*BLfkO235EYe_iV(p@T+|
zc?tN(T+6uYwCX-+Cz=2`QK{p(RMSk=(SzzA{f~h$uEKixycv&vQ~TUIW!ow&`d>1l
zF8HIhBk<5RtRztVaiMxq`ZX34`4_^P_lPzCVb3y#KmWn$XKsdY7DG2S0a}3i0TTv|
zK7x}~XyUD{)1WO)&`tBrI_B`Z>43LEGa33|(bOI#$eIHa1`kgc8^Uoo3rzP#!2MPkT(h2G1<$i*E^p;E7
z(tTOyffHxaQg+QW_h84{AO#z-G9r_^F9~gMxujjscho@kDA(}Y*A@GFq|bL)ME8A<
zFGwV$Ee_3oDAIlR`S8L&+VGg55rt4MhOLKgx&_cfh
z<5`cx{jgNYI1FIi60VsDSoyur4!9|mzNHB_`1E%MC+wR9pfg;`Q~iz`pQ(Y}Ds$(E
z+|>t8BPCQs&avPA28oDN1lsMgFcx&Grm438r+^7{(2Bf0F68lKxb~mz`(E=8xo4dE
zUAeV1`e<}elDHkFXWrQJr5)H3DV|KIe2a54r0M$O>E#9Y9zRam5n&PaW>w(v#rgE}
zF^~y-$yq6a7$KNYyX&urDZ+f?L90dep4RT`@?C$I3{T;wIy(x_N#w~9kKJ(L`~?in
zF-H5lXx?A$DS^~$rfg4lO(ORPr~lQt&B*?wC(dTXG}+=%EfdWt~~wiauMol+&jX#`pTV_$GEkZ)B-z+&ki12X){BUAO7y}{S1Fa9C$&?ktbRxjMm
ze6P~*Fw`r?7s}<~afVzLy>BM36{rL}0_!M&yJ<6=lmXaYg}tvI2y|)ASUC?fwGSU(
zN=r?&k+eyonVpXAyj_t>Qo4%7_0}CSOs$(<3@xbT?_jz1k|9n?gq1xCKWK2WAaQ`oQ+rKM(&8Eci!vd*pki$L)x)F3gwNSNsrG
zrV?yvwf9B7ZfRjSV*I703xSfhS?IeiE8~v>Sguc9jg(G*n+DZ4g{tY#N`*#Z5xM$`B0Zh8Y>T%S7
zFb!7zI%2}|i5?Ckg4Ad!Yhm~t5fp5ofYcwyY%Xx&L|ClE;<5`0?(vB5(UJ!4?PU9I
z_E3R3H4vWi%|v7YR!>XJDC(oA28|}(M|TTs(^$V#f$T&&o;JD7X@4}NrN0&AL_r&u
zYBz#@!y9{3K-trkK6CGF%-P&dD_KhV{@%CT#=WZqGr=YHQQ62Llw-NqJwYGRmoN!d7Evn2#
zz)?x;bmz2cic#oRqkc;3m%X`vOlp+*_xiz%X7Lb-os8WfwAYKnABKI6evRLQPN(>k
zyi=eL3JbnuOfaj!^bEfQJTA6LL6BB5HZ#w9GG+6XU*oS^(t?)13#g#YM9$Iro#w%*
zDjuqqP~x+-Ub&k`Zbm?Q$UgK?rsz0dQh=UxxXLm~#HCi(w+GASav
z4Vv90(a!9>S0P@S~3H`t)
z0r6UpUnZGpK_4RvBK01DJh;Wdd%@yJ5Y!9=#y$%hnPVU4|7HkQb
zHj^Sxt&3-NynJX`WM!~)carp8EBF6!%R%bDe9&PkzqbTi6;vpaFycYD2Yj6!pL<|1
z-Z;p`AmZWCP}eb-`f$4<8Yo}6M=o;7JrQzs+@1Ky7dOaMRCprQz;P$oeL!I-Ulv42s)OS>C-?$w9h*Q=EuI@`v2oV-~VGa
zpFo)C!UX!x>$pqukMqybl~4J?c43f_Y+#5mgp)S83o^9#8UgV
zQonfdK+CNJOqb{~NKdrD+0cAw60)$4u2|4~9E6}>LT3bLQvXi1Zju&JO-xI+F9+wk
z-Im;DlZ5amuqFtEYzAXKm8}lO{okVr_%A$Z@NsuKa;>7G0cd=L2X3H1?%x{mvS;~&
zwW0W>aLx7n<}t`TNm4h=JhV#zcbGoRSHslrUcwi(ReFFRqrLrAQM;|Xg8K3qbdR_1
zqjyj?X{PZ6=Gzpthgp(`iMh@vS`+UaDT2{1kmo5t4g^{VXAN?Qgzwx!thpz%3#?_NeLlOtS%EyMkuLBoCZO;%#Ro
z#0gdi|HT_aEceY_mnRdFdhrj?*o9U5&ks?y_sxj^ZxNp-{Hw3vBvetmUcn##Gq!Yd
zjthdanguD=(6XPKN*{c|b9xK9%w7YX(~gXNEfruzU;^YInGKI!^~~fa!kz*!GFrOI
z1B3%68Z{U?*-5z-G@^aCwc;v#Iwq18qQ5hd+~M-B$p*0_>NW!n)OGn8f?)KxJqjm2
zUoLPD^!rxN)3o_DU;2M|X=V8zn>@n35+usF=jHwm!zk=2$bhG%Bjw^CiPJRr
z@tu$qPgo~d^=Et1_B$eB^j}ajM)vxbzdvaH(F`~m9&-Sjr`r$KD6entHIdGP*K0K{
z^I|rq>_aa18zeSiQz<-LUy2ctDUAc*PR-{kJ|746Yj^>cdJT|D)(>l%1OXYuX`%2H{VO_-;OkqZ
z-aW*z;9v*vB3h5@3ALdcWrE@Ly9bcF6VB`C@VkRC!EcbZr}f;5VamGvHe{&^6yZ)vO{O82BQl|F8*E}T&~=KsbG(4NeHWPS%e
zwOF#l^bMFU+&`!uI3Bo~H;onYiF9_)3i>q-f2meYmR#=
z)Oq=|E@6kdM4ui;K2tiD-;vfcM;IWC^!OPT86UEvo8bBmskhkU=5IaZf+^d>R7-ty
zgP(rRAJ1|-zG|&M9Y8vbArCA*S;pGl9#@$xfB$$T1(_sVL|Q$hr{^V&Jc@~B@QXUl
z0^~Z)))P}nhD2+FLp|)*rnT-I(}OHgs8Lo2wlOB}sWQ{YRs8oKW=t_??Cq>IL2g(e
za~0vl$5PppWEfS>*!$;8c@0uWuqj_PK17nE^pMHuFYo-WbMUu*EsuTP>#`e*w%A~Gp-$fP=3zcz+alAI{)WiUn~v|No5ugrCL06sDj+-=Ze
z!IhfqtBjqZ45Lg{&f5>3Saj*c3h#X8Pm%NKZJ*HyPN>|=$M5g|@kL2ekz{)MjqGVl
ztVkLvXT=+@t2Lww$A~tkC{#to@|{T|{Z_u223EzzM-Ot-qgm^qG8G
zwlh^Jo$Q+ajF%-(SmUNz9gOo#6@6&tkU_bV3x?*J!x@cP_kMSx!LIo
z%A4Eiyz*N+?gsGz-JV{`-62N$s5lw5tfnaS%`u1Y!k>JpKO7ML_FBQgUT|U7uxRzk6FT+E9Rm
zxx&#gk-q3x;U4+?#pRbc_Byo4&9c{9t^!(SX6B~W`;W;uIsF{XY0`;(Tf944dyDGj
ztmL@-{GMcFXX;g`4Q-0aZ5<)5FK)ajC57|Gz^_>36;+@&L0EqO%K|_m4C7Q7#K0%P
z3dBP9f9BuXrpL<0He52Zd%hwF;c=zx`11!zQ&Te|BV$3zHdS7V;FNb34*&E?IaOFx
zLH7Y(p5MxffrDC!oXG#)p?tvnzdz!0s($}YuRC|w#mzv5Qmis6a2b%qN#8$dNlpg+
z*v;0ahZ;lBQhyljAN;D-m!h@RHWayB4fpvge3z3&1Jo><)UmlMT;mkSp#$7Yer-yU
z?R3bjFpQPdc$_qB1EcWQQfJ-yu`z~qVrhwr5$=LoQ|u^X@21B(nJK^W{IR!&0!|n)
zq}hJ3DWI+{Au*BY_5yPKMqUsxnW34Uoejj&bGyx9LnH@+-JjoALPKTS^lTM1F(;n+v*f!HK%x<%hS=(B@cHZmZMITOa=0w{Cxbbi}POX
z;#X&nios}wypft+cNZco)(J1ruLEjkYT|9-<)Mu*QDk6Gcy!iC_vy$p(
zStBuI=mE;S(Q(!b9^x>5p>Wcs^^W7(VUzNlvERBA0UdfA8Z|vlLgx?np$C{Vl~&-s
zW;i$aQm@C%!Lfj5=35teO_%22e${RX`Q=o9ClI>wjM~ZXV-2@u^AvdSF52+>c;2re
zvmw)pbGY%ghy+YTfP}O*<(FdaU$cs;>syBg363BJ&GQQrjtz%e`LSh+`_k}@Y!)IS
z@o$yL;p7sXtePLJu}{^VIYq|RMwCXb2Fp(7->2!=eD|&PDh=WTr
zy)GLCDWSjT$WVIkFo$~07;^O`j7TsnjkYgNspD0$8;p3SYR+LkIa#Q-4rRZt`4b$|GNY(s
z&lxK|#x&LRP%JJ*&B?
zhF4HB?=)I)*Xxo4pJXLX_~aLbKk(J8+FCqkXYP@#(=xCo-C4E*pZm8uIMo12YGi6m
z^h-=aM~B$u)n(1}q=>ljs~|RxR0G%NtNQlLujTq!9x4Z}&Mui;IB%~oS1$9s!ebjA*+1N%mNz_o
zB6P8k-sZ~+?rj}sOqi^6Jht>XlAvsn_qt>N?*KDY?14&!-4lLiD++ds<-!one{0%>
z1?HQY`!)D9-3}q;+pzD(>&X@SRPOUziQzn;?rJhR-sxCo(lh9@1^AJ}+*
z{mK&&&~gfQ;UMVh9x5@649yIdQ7JGxajS4?+^1(7I{3VkEB_K*gN$TXB>gIbv{Ej8
z@haS6!Qa}`x8GzTn0~Fy#%;iIz}Y;Aa^#@ZxFi~v+>b)zmUJ+p((%ceXc@Be$2_dN
z%KjwYMR%^(@r9bLyH22IyEP<-oN%zQlgxfxQnP0dohTfdm=8~*ef+JN|2xK_4L(wm
zoOp-j!@iU9Ps#-v&0in+gO1R6>y_+z=87gMnXgh3lEL~@kR;E%pYg&&h*FZ8Aar)q65O17t?BLD_syNWw1V|_dLaA==4y8H>yGui)GM9SB
z#Iod5ye1xLMoEc+J|!=3YeG&L-nr~?FeG%8Ew4XUU!!CP2d@Bn+pN8Oe3iX&jT9I6
z+GFup{siXUN<%_
zniXX)n^Rrr?E?%;OXBpW-H#F>+Rev=m^YSDtzn_jgqPiFJF~opEE!~fxFkC8zT&06n)2Ck!(_J8z{{y
zX05b>hDY9%Nnt7s1BIzJM{bX99;p=I;W5R^zkh%GGsKXMh~Ej^vpXm9G%-G2N!
z_T18Z|5tW44d&Tqb7rhiQPnD^
zeqW!Xpq{sL?sp%ywwTaoNWgn;Uk=0?7?SV>y&{bkywGpWWV8zykF8!G!D*@5Mdh6E
za&vPH3=IKP6;)7p170vV$`cm3i(SjSY{-I7OWS4Kew3LgWRETh<8fW$$Wt!V=?F=q
z+mtP&McpMPb`hA9gq(MNdW(BYhql-WzNb&Cc-YXY6HTS%Or@WxtLu5j{F#Y^^SRB+
z2CLA84r%HEO_V#pghLWPt0_~_PO&lkT7SLM2m%=J2UVN|hcG2p!|LOR?Kl}RwqbUg
znnVLbW7hOy@5Dq4fW2&MG%~U>W)F$}1C85+$DS|zTf2G=Y|Tc^hDQ_;Baqty1hp-s+138a)1A@@1QCd1)E_tKizZ469%M~Ov+gGv(?DwghyHu2;iSpHbI
z{(lYEl2aqFcwLYgH|kA&WAjnI8D~b8*;Ea@qi2;`!S3n-4qDHr313WU#C6wcGGWxe15f=7kSKukNxsVf2H8{i^&Wsa9OA%hO(8ilH{4
zO@OtgN&}}1%dFfBO`IXA(Q-Yvi&q-pu9cpA(i^&TW=68*eTa8^$urfXrR^&u(P!8%
zI5AI>T9S`eT=th_T|I@~=KVG`HwV+0fghopSc7nbRec^Da>=4~4TLMnbV<@!-WRzo
z73$u=$m|0b0VIH!6%+*``}z`M(obCkE_}YWO}P0aUtg=os85(x7#L)f>31p@a#kIT
z&(s}U-TaLC0=Uq}yitqka$VtNYcsR8t_c0nxtFkTf53PaB|0qFBI4tNKwIbLM#;7>
z{!%xx_{XYBmn)%U%3^YtOHrfH_PpA$u8!C3`mx}L)omJbd^Ggu>{lqrlV$6geAE2J
zQx?lYMI)O!-LQ66BlA6TNdF6P~eLfFYc?3Bpv-fF1!2lUN1fIsU5wfB%h)N9X^`d@bEB8d`Pv1Tp~IO
zQ%o>U%=5glZ&L;>MpcV;H4>FGf45K5lSNoATw#M*q0YB52W}1NZ+i>J%;LDMnJ^&b
zkrVSSk$Zb2a!EoTbafwyiu$QAtR;|q@l5?bVmyHL6nSX-w2$_!LFXA`tMc!ED%O1k
z^N{gf`4_`|(oi%p4J=vLWM1#_xw!FxwtdNa!>-iXaf&xyP!d40f)Q&XvuO9hH-4HW
z>hqiULQ(9o2Rbav9QdPsiK)hOM33x^2)n!GT6A76US!LvyYpM`Pq$iYxe5+lVe71g
zkV{ER@8QE}GWlW;eXP?J^XP8sAg>+YF}1q|bk07mr}>)@6xdlS$+m`lK=fc#C2{5>
zj^XTswSMrt>^F}LuWy@w@!$n7Iyo;pInTQ#!rGSFgQ+diB1K`8e0+SlO%8!NHa3}>
zUbhZXQbu~!qObL;>Iet_(9rvzx(Pmcf~fKg;UsvmX}alwkk+_mxUq%?+pMguCZQlByC7C40?<6E8B|!pdCQEKZ9;bD
zJ?WhiEGNz8K_}bsJon_|={(+f8h4Ugz{un6eKOv$Wbdt)FsL#UtTYREu5|#oTB@$lJNLFzT|%^E#ze=U3t04
z)Kz0lWcEW}3LpBAF|)3o;S#G*ztHW1f7xi;5^7Qs>(&;<&lC(rB|^v=&n5lq#7@DCdv=Tb2fq@YL|hUpDkZIo>vBWRh6ewF1tPg0f!
zWXmvyYugw9AAiO~W=BrhdU0xo$6j!x(GY2-m^Weg7;|eLiDFbq5n)R^o
zGUdF~@{CyH#!D)X#%A1KUQq9#pttD6e8Q5ptYYc9E$7`jEG+hGXi`Q4WQ>9@BD({O
zHaHC{rm^z8#>_Z3H%;-;kU?WJ&COLQh<>IG%?B64!{JtH{+I9ND?joGsED~g?8CE9
zL%BJ1;3ICjbDyu>WCbwnIcG)v(U!GB?kC!ymgs&$*QJs{*&JhcfcJZP-V!7fMnpw*
z=MOL0rkIzL57DmTMiB|Qg{Uxm7fXM`$QT8AVT#aca?BJ)STdiwpR?qHr=UQ2R*Dj6j3Gkrf0?piDq!yD}?58eSd9ejG~QGSOc
zD?71wdFptn@yU#0pl`l;=9pS+n>-|%_t$Ww0Yln)gB?smh={(UNebbXl%)CT)2HEy
z34gG^57Ydv7fC%5hGC2E;hXHnn|5`ZJ6kP_4lH#RcvRdw*r8&9B54w(4kPA>8!v;+
z$QkmXr;k2R4Oxq2kHIn~(nrGfCfHP?4_!R#%iJ-(>b&&s>qA=`i2IiUdFTf6|>qO>~JW0(S-O&g%JQGC?6&zToi@v^4eR%cGWM&xtmzYFWg=N
zbeFHZos-g8_lBL_zK<%)(+l!yo0+P`F@2~jq@|?}uTm}x;Po(K{`a!7#4MBU?pNde
zeTfPjnR#6l5l=ZQ9Ir3#?%YGfDCC6>@q42g-|*8v_tD+i#{~>QON(j#W`I;lMTO-F
zMdMuoxQXWR5kp6*dT*oi`l_zpKJ$x&?>?)zSWN7PMD)-+Ft>f6c&1cQMu
zempK+;?mLku`*_C?Eiq~UTRjvV%e{vqHrG+411lsH=oc7AAZRjYonRGavJ?)
zwv!wFYn(ED#5i5i^qrw_m`KeL#Op&&&7&w~>G`2!9IyRtXNKiH4DpK?&rZbL2a2o3
zp3=Sq>;1Hf0%A!RAl&+UiBl90?Np=hk7%>B+y(L|>T^_;a+BtOts?6-
zOQebTghLde%^UdaaE~}CarNrt$gpA@Z+bvT$jQuHXSiRhu9^8Z53~^rK!Ut62DNJM
zw3cgi66`<`6I09dq9RhH;IWnyQ+;N~n}ZMh8+&`HH8p;m=E@~@?WMMUUMXUkRPBKK
z5oM3q7Wu;#B;=^ixv*)hI@lLd>+8u6Pftu;c{B%5td@j%h}ITTTN8Qh@$h%7lOiKq
ztD0^K=yqipC9z~D;t^xg%u3FOSV)eqm=7zA8~g5+k8jtTN>01-k0fCM?RvBmgG-M9
zs8y|XV6Ca)z5l49&({HUO-*%rQOa<9#$T74lTVF_oUal;xvozTid>+~
zpBi=Z516mLV9^&Gk<_2k^Q;Es$U1=XcXsgx%Ea4hV$@!
z9H2!)v+L